Microsoft
Here are some of the key reasons why you would want to run Unified Access Gateway with DirectAccess.
Part 1: Security response for the small office environment
December 12, 2002 12:00 PM ET
What is the purpose of security response? What is the process to make security more effective given unique business constraints? In this three-part series, we will consider three environments -- the small or home office, the small to medium-size company and the large enterprise. Each has different requirements and associated security processes, and we will touch upon prioritizing security responses for each.
Security neither seen nor heard
The first scenario involves security response requirements for a small or home office LAN. Security in this environment should neither be seen nor heard. Admittedly, few people are excited about reviewing their system log files. In addition, few people collect attack statistics from home systems (unless you are a member of www.dshield.org distributed intrusion detection) and even fewer care about failed attacks (such as Code Red on a system
Computerworld -
The security information flood is rising: Just as one is reading this article, a company firewall is probably spewing forth lots of "TCP incoming denied" messages, an intrusion-detection system (IDS) is filling the logs with alerts and a Unix syslog aggregation server is about to fill a new 40GB drive. Too much information effectively drowns the meaningful security events that require a response with a thick layer of noise.
But what events are meaningful? One can use a vendor-supplied priority rating for events. But the same alert from an IDS might mean different things for different environments. For example, a critical alert about a Microsoft Internet Information Server attack will mean next to nothing in a Unix-only network. However, many security products are shipped with fixed "priorities" for the alerts because there is no way to incorporate the unique site requirements.
This article will address the issue of "security response." It is defined as an incident response (IR) taken in a broad context. Security extends far beyond the IR process, which is activated only when a denial-of-service attack hits the Web server or a malicious hacker breaches the perimeter. A big part of security is responding to daily security events, such as log entries, alerts, etc., which might or might not develop into full-scale incidents. Thus security response is a reaction to security events, which can range in severity from a new line in a particular log file to corporate espionage or a major distributed denial-of-service attack.
 |  |
| Anton Chuvakin, Ph.D., GCIA, is a senior security analyst at a major information security company. His areas of expertise include intrusion detection, Unix security, forensics and honeypots. In his spare time, he maintains his security portal www.info-secure.org. |
Security neither seen nor heard
The first scenario involves security response requirements for a small or home office LAN. Security in this environment should neither be seen nor heard. Admittedly, few people are excited about reviewing their system log files. In addition, few people collect attack statistics from home systems (unless you are a member of www.dshield.org distributed intrusion detection) and even fewer care about failed attacks (such as Code Red on a system
Security
Additional Resources
Microsoft
Review how one energy firm tightened protection and simplified IT work using business-ready security solutions.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.
Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
Death to PST Files
Download Now
The Tangled Web: Silent Threats & Invisible Enemies
Download Now
Tape Killed the IT Guy
Watch Now
Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity
Download Now
BRM: What You Can Do To Reduce Risk In Challenging Times
Watch this webcast now!
What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices
Download Now
Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".
eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...
Computerworld Reports
Sign up to receive updates on the latest Security resources
