Security: Back to basics (Part 2 – Knowing what you don’t know)

In Part 1 we investigated effective end-user education by making them take part in exercises to ensure that they are aware of risks out in the wild that exploit the well meaning insider.  In Part 2, we’ll educate the IT department by learning what’s happening on their network.  The best way to do this is with an appliance like the Symantec Security Information Manager (SSIM). The way that SSIM works is by collecting logs from a multitude of devices, whether they be network devices like firewalls and routers, or application log files like IIS or Symantec Endpoint Protection to correlate events to determine if any malicious activities are occurring across multiple layers.  This level of visibility into the enterprise is critical to maintain your level of situational awareness. Symantec’s offering is unique in this space, using a file-based approach to scale significantly higher than other database-based log manager and correlation appliances.  This gives you the ability to handle tens of thousands of events per second, allowing you to monitor more devices. Incidents are prioritized using its built-in asset management function, which is populated using scanning tools and allows confidentiality, integrity, and response ratings and policies to be assigned to help prioritize incidents. In addition to establishing priority to events, Symantec Security Information Manager can provide recommended best practices for response and remediation efforts. Automated updates from Symantec’s Global Intelligence Network provide real time information to the correlation process on the latest vulnerabilities and threats that are occurring from across the rest of the world.