How to successfully plan and implement a Security Event Management System

(08/03/2007)

A Security Event Manager is a piece of software which takes as input logs and alerts from a variety of systems, such as Firewalls, Routers, and Servers, and attempts to inform the engineer of unusual occurrences which warrant further investigation.

The SEM benefits from having available to it information coming from many systems at both the network and application level, having an understanding of event severity, and may also have access to vulnerability databases which describe common weaknesses and their exploitation. SEM software may also feature tools to aid the analyst charged with investigating events and producing reports. There has been a vendor-fuelled explosion in acronyms around SEM, and you will see them referred to variously as SEM, SIM, CSEM, CIEM, and ESM systems.

All of these perform broadly similar functions with differing scalability, utility, user-friendliness, and price. Although vendors may use different terminology or allude to proprietary methods, all conform to the same basic mode of operation.

IT infrastructure, particularly security systems, produce vast quantities of logging information of varying quality. Although there is some consensus among groups of vendors for specific applications (e.g. Web Servers software) most logs do not conform to any common format, and frequently do not even record the same basic information about what the system in question is doing.

Generally one cannot count on the individual routers, servers, and applications having strong log file management capabilities, nor are they able to confer with one-another on the significance of a group of logged events from disparate systems. This means the hard job of the security analyst is made even more difficult. A SEM system is intended to assist in identifying and investigating anomalous events among this glut of data.

The goal of SEM software is to dramatically improve the signal to noise ratio for the security engineer, and to allow him or her to more easily identify “real” threats from false alarms. In this way SEMs act as a force-multiplier, giving the analyst an ability to do the work of a larger (and possibly more highly skilled) team. Although much is said about the technology involved in the SEM process, ultimately it’s all about getting the most out of the human in the loop.

Download the free Security Event Management System implementation white paper.

For more details, contact Steve Murphy, Phone: +44 (0)207 801 6309, email: steve.c.murphy@trinamo.com, Trinamo Solutions, www.trinamo-solutions.com

Related topics:  IT Network and Computer Security   Security industry   Security market sectors 

Print version | Email to a friend | Related articles

Data breaches: Trends, costs and best practices gives you all the latest information on securing personal and corporate data, key recommendations for immediate action to improve data security, and how to respond to data breaches.

Other Security news and resources