A Five-Step Plan to Help You Stay Ahead of Computer Security Attacks, Risks, and Threats, Part Two

Security information and event managementarchive logs from different security devices, routers
software rolls up alerts from firewalls andand operating systems. A security information and
intrusion-detection/protection systems, along withevent management system's data gives the security
event data from antivirus products, databases, Webteam direction; after that, they must still physically
servers and elsewhere. It offers two tracks to getfind the affected system. A configuration
to the source.management database, which holds information about
Step No. 2: Follow the Threat to Its SourceWhen anthe components of an organization's
alert shows up on a security manager's console, it'sinformation-technology infrastructure, can help. By
as if someone set off an alarm, says Morrow, theidentifying components and their status, the database
Chief Security and Privacy Officer for Electronic Datahelps security managers zero in on the source of
Systems Corp. The security group's first question istrouble, though that doesn't mean all devices are
obvious: Where is the problem? But finding theeasy to find; a laptop plugged into the corporate
answer requires ingenuity. There's no single surefirenetwork by a temporary worker or other visitor will
method for finding a security breach and nailing downbe elusive. For all the automated sleuthing, a certain
its scope.percentage of devices will be discovered only by
The task is still more art than science. Event logssimple hand-on crawling through offices, plugging and
generated by firewalls and early warningunplugging things. When it comes to detecting an
intrusion-detection/prevention systems give securityattack, human intelligence must support automated
analysts one route of inquiry. And the demand forsystems in determining the scope and severity of an
tools that help correlate the mass of security dataattack. Security managers say they seek out the
held by the various systems is growing. Securityaffected asset's owner.
experts advise looking at security information andDetermining the appropriate response means taking
event management software, which helps securitythe attack's venom into account. Besides wanting to
managers detect incidents, for clues that may helpknow how many systems are affected and the
identify the source of the attack as well.location of the attack, security personnel also seek
Security information and event managementto determine the insidiousness of the attack. They
software rolls up alerts from firewalls andwill want to know if it is a random exploit or a botnet
intrusion-detection/protection systems, along withpropagating through the network and reporting
event data from antivirus products, databases, Webinformation back to somebody or some organization
servers and elsewhere. It offers two tracks to getthrough an IRC [Internet Relay Chat] channel.
to the source. One is its visualization portion, whichSomething like that is much more impactful."
looks like a large, continuously scrolling spreadsheetWhile corporate security groups chase down
and provides some amount of detail on a networkincursions when they happen, they've tried to
attack, detected virus or other event, including thebecome more proactive, looking for and fixing weak
Internet Protocol address of the affected equipmentspots before attacks occur with the help of
and device name.vulnerability management tools. Like
The initial information gives a basic sketch of theintrusion-detection sensors and firewalls, these tools
problem and where it may exist. Every devicemay feed into security information and event
connected to a network is identified by an Internetmanagement systems and configuration engines.
Protocol address, for example, which can guideMany organizations scan for vulnerabilities on a regular
security personnel to the general areas requiringbasis, allowing security personnel to determine which
investigation. However, there are limitations to thissystems are vulnerable to attack and patch
line of inquiry; one is a lack of context. What doesaccordingly.
the IP address mean? Where is it and who is usingBecause cybercriminals are becoming smarter and
it?The other limitation is that an attack may spoofmore sophisticated in their operations, they are real
the IP address. Security analysts thus have to digthreats to your personal security and privacy. Your
deeper into the second source, the event logs, whichmoney, your computer, your family, and your
contain more finely grained detail. They'll be lookingbusiness are all at risk.
for Media Access Control addresses, which identifyThese cybercriminals leave you with three choices:
network nodes, to see if a given IP address is1. Do nothing and hope their attacks, risks, and
correct and valid, Lawson explains. The logs also willthreats don’t occur on your computer.
provide details on how an attack progressed through2. Do research and get training to protect yourself,
a network. By examining the firewalls and routers andyour family, and your business.
operating systems, analysts can piece together how3. Get professional help to lockdown your system
many Media Access Control addresses, Internetfrom all their attacks, risks, and threats.
Protocol addresses and routers were targeted in aRemember: When you say "No!" to hackers and
given incident, Lawson says. Security personnel needspyware, everyone wins! When you don't, we all lose!
information beyond the alert itself. A good security© MMVII, Etienne A.
information and event management system will