Download

Final Thoughts • Chapter 7 257■■■■■■■They are designed to not only address extremely high event rates within governmentorganizations and large enterprises, but also provide frameworks to make thatinformation understandable and actionable.They are highly scalable and capable of supporting geographically dispersed deploymentsas well as high-availability and tiered architectures.They have practical uses for both real-time analysis and forensics investigations.They offer tools that help augment human intuition in the analysis process, such ascorrelation, anomaly detection, prioritization, pattern discovery, event visualization,and event investigation.They have integrated event annotation, case management, reporting, escalation, andalerting capabilities, which aid is incident management and policy/process workflow.They can interoperate with asset configuration and remediation solutions, having adirect impact on network devices and access control systems in both proactive andreactive scenarios.They have granular access control and auditing capabilities so that multiple usersand groups with diverse requirements can be supported simultaneously.Final Thoughts from Colby DeRodeoffIt’s no longer a question of whether physical and logical security will converge; the convergenceis upon us and the only question that remains is how organizations will deal with andadapt to the changing “threatscape” of today’s world. We have seen through numerous usecaseexamples the operational efficiencies and layered protections that can be achievedthrough Enterprise Security Management (ESM) and correlation, making the decision toembrace a converged solution not only viable, but also the only decision that will lead to acomprehensive and complete global security organization.Colby’s Rules of the Road■■■New technologies can be an enabler if they are understood and used properly.Convergence depends on a view through a single pane of glass into informationprovided by many disparate systems in order to get a holistic view into the overallsecurity of an organization.It’s easier to sneak into an organization and steal hardware than it is to hack into aWeb server and access a confidential back-end database.