Five Principles To Improve Your Security Monitoring

Following a year full of breaches, companies need to focus more on monitoring their systems for signs that attackers are already inside, security experts say.

To better defend against and detect attacks, companies need to take stock of their networks, find out where critical information resides, and use that knowledge to secure and monitor their critical assets, says Mike Lloyd, chief technology officer with RedSeal Networks. A recent study sponsored by the network monitoring firm found that seven out of 10 security practitioners believed their networks were at risk because of improperly configured devices, and more than half of respondents lacked the knowledge to create metrics to measure security.

"I often end up talking about Sun Tsu early on: Don't worry about the enemy so much as ... worry about the terrain and know about yourself," Lloyd says. "These two same principles occur in IT: Know the network, and know the end points in the network."

In 2012, companies should put a bit more Eastern philosophy into their security practice.

1. Know yourself.
Companies need to take stock of their systems and networks for two reasons. The first is to find sources of information that they can monitor. Firms should go beyond monitoring just firewall logs, network data, and employee usage patterns, and move to analyzing access logs, domain name requests, and any geolocation data.

Getting that information is not always easy because the security team might not manage the asset in question, says Eddie Schwartz, chief security officer for RSA.

"You look at some organizations, and they have roadblocks in place," he says. "They can't get the information from the Windows team or from the firewall team, when any data that is relevant to solving the security problem should be part of their assets."

Find the sources of data and get management on-board to get the data you need to monitor the security of the network, Schwartz says.

2. Know the terrain.
Using various logs and traffic data, the next step is to find every way in and out of the network, as well as every endpoint.

Sounds easy? It's not, says RedSeal's Lloyd. Half of all security practitioners do not know, or have no way of knowing, what resources can be access from outside the network, according to RedSeal's recent study.

"Many companies will say, 'We didn't know how much we didn't know until we analyzed our network,'" he says. "Gathering data about the network is not a simple task, and most organizations don't know about every device on their network."

Taking an effective stock of the devices, as well as connection patterns among the assets, allows companies to know from where an attack might come and to detect odd usage patterns, as well.

[Security information and event management tools must catch up with the elusive advanced persistent threat. See APT Shaping SIEM.]

3. Know where to defend.
After finding sources of information to monitor and the layout of the network, companies need to inform their monitoring and defenses by knowing the business function of the assets, Lloyd says.

When incident responders see an attack, they need to know where the attacker could go and what data could be in danger.

"A vulnerability scanner could have a lot of value to the network, for example," he says, "because an attacker in control of that asset will know the weak points of the network."

4. Know the enemy.
Industry experts disagree on the importance of global threat intelligence to a company's monitoring plans.

RedSeal, which focuses more on helping companies understand and secure the network, puts less emphasis on keeping tabs on attackers. RSA, which has about two-dozen threat feeds, is focusing on intelligence-based security as a significant evolution for large companies.

"Security has to be more agile; it has to be more intelligence-based," says Art Coviello, executive chairman for RSA. "It is not whether, or if, you are going to be attacked or breached. It is how you are going to be able to respond."

For companies that believe attackers will specifically target their systems, keeping track of the threats can be key.

5. Measure security, not work.
Some companies measure the wrong things, and that can set them up for failure, Lloyd says.

Using the number of updates applied, antivirus definitions updated or other measures of work do not make a company more secure. Instead, it puts the security team on a treadmill, where they have to run faster every quarter to meet expectations, he says.

"Security is the absence of something, and that is hard to measure," Lloyd warns. "So what you have to measure is posture -- how far you are ahead of the next threat."

Instead, companies should measure metrics that improve security, such as the number of vulnerabilities remediated. "The trick then is to make it quantifiable and repeatable," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.