Every network device on your network has some type of logging capability. Switches and routers are extremely proficient in logging network events. Your organization's security policy should specify some level of logging for all network devices.

It's important to deny traffic you don't want in your networks, but you also need to know who's sending that traffic. Some resourceful hacker could be hammering away at your outside interface and eating up bandwidth and processes. You need to know where that traffic is coming from. Your access lists should be logging all denied ports and protocols.

By Michael Mullins at Tech Republic.

[ Read more ]