Monitoring the network 24X7 will alert organizations to anything unusual that may signal malicious activity. Security monitoring should not be limited to just security devices. Instead, monitoring needs to be holistic, encompassing applications, databases and other critical, high risk components of the IT infrastructure. All the security information generated by the environment must be aggregated and correlated in real-time. This will provide security teams with the context of the attack in a timely fashion. Armed with this information they will be able to respond quicker and reduce the amount of exposure to an attack.
When incidents do occur, it becomes necessary for organizations to respond in near real-time to minimize the impact of the incident. To accomplish this, organizations need to have the proper combination of people, process and technology focused on the incident response efforts. Organizations must deploy technology that performs security event aggregation and correlation to facilitate the rapid identification and response efforts. Security teams must then have dedicated, properly trained staff assigned as Incident Handling experts who monitor this technology for signs of an attack. SANS' Global Information Assurance Certification offers specialized tracks on Incident Handling that can provide the appropriate knowledge. Of course, these dedicated experts must augment this training with extensive experience. Possessing a wealth of experience will enable them to recognize the attack and respond quickly to the threat.
Organizations must also develop the appropriate Incident Handling process. This process can be set up in a flow chart style. At the top of the process is receipt of correlated incidents. The next stage is categorization where incidents are classified by type of attack and target. At the bottom of the chart a threat assessment and appropriate responses are assigned to the alert. The goal of this process is to have a repeatable, disciplined set of actions that will reduce exposure time and provide an audit trail to measure effectiveness.
The final component of an integrated Threat Management program is the analysis. Organizations must conduct data mining to determine the effectiveness of the program, areas of weakness and the overall threat level facing the organization. Security teams should be able to achieve this by performing ad-hoc correlation and generating reports. Proper analysis can only be performed if the organization deploys the aggregation and correlation technology discussed above. This will provide them with a centralized database for all vulnerabilities, incidents and their associated actions. Analysis is one of the most important components of an integrated Threat Management program. Thorough analysis will provide the feedback necessary for improving this lifecycle over time.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.