A checklist for buying a security event management system

Computerworld - To better protect themselves against the proliferation and wide range of network security threats, organizations are building more complex, device-laden security networks.
Today's network attacks are becoming more sophisticated, and it's increasingly difficult to distinguish actual attacks from normal traffic. Best practices dictate that event logs should be periodically reviewed in-depth, looking for anomalous events indicative of an attack or compromise, rather than waiting for it to become apparent in a catastrophic system failure. The process of extracting relevant information from network events is tedious and costly and often results in delayed incident response. It can be a real drain on IT organizations. In many companies where IT budgets are stretched thin, it's not being done at all.
Consequently, security system administrators often consider purchasing a security event management (SEM) system. These systems help manage this large volume of security event data, allowing network security staff to more easily review event logs while adding some degree of event correlation to reduce extraneous data. Newer SEM systems apply sophisticated analytics to improve correlation, filtering out false positives and normal traffic noise, while escalating alarm notifications. This allows network administrators to respond to critical security breaches in real time --- not hours or days later, if at all.
What to look for when purchasing a SEM system
There are a number of features to evaluate when considering which SEM solution is appropriate for your network security needs. They are:

• Ease of installation and use. The last thing IT security staff needs is to have hardware and software that is cumbersome to install and maintain. When shopping for a SEM solution, the hardware and software should readily integrate with your network devices and configurations and be easily installed and operated by your current staff.


• The number of security devices and agents supported. The SEM system should support the majority of your security devices, including firewalls, routers, intrusion-detection systems, virtual private networks (VPN) and vulnerability assessment scans. Adding new devices later needs to be done easily as well.


• Ease of customizing correlation rules and analytics. Every company's network is different, with unique challenges, threats and vulnerabilities. The SEM system should be easily customized to correlate events across network devices, including different device types from different manufacturers. Specific analytics applied to the event stream should also be easily customized to adjust to normal traffic patterns.


• Accurate real-time display and response to events. You need accurate information that you can easily interpret and act upon in the event of a serious attack and before the network is fully compromised and the damage goes too far. And you need the right historical data to begin incident response right away.


• Cost-effectiveness appropriate to your environment. Factors to consider include the efficiency gains by your IT staff who no longer have to tediously review log files, as well as improved security resulting from heading off attacks in real time. These must be weighed against the total cost of ownership of the SEM system, including integration and maintenance costs.