Log management & SIEM
- 1. Log Management Security Incidents & Events Management (SEIM)
- 2. Agenda • What are logs • Why do we need logs • Problems & Challenges • Best Practices • SIEM
- 3. What are Logs • Historical Record of events that happened. • Records events and status of systems in a time sequential format. • Record of activity on the system/network. • Provide an Audit trail of who done what, where, when and why (5Ws)
- 4. Why are Logs Important? Logs can assist us in • Determining what happened - AuditTrail • Intrusion Detection • Incident Containment • Forensic Analysis • Proactive Protection • RealTime Alerts • Providing a Network Baseline • Determining the Health of the Network • Troubleshooting issues • Proactive maintenance
- 5. Where to find Logs • Logs are everywhere • Operating Systems • Applications • Devices • Routers • Firewalls • IDS • Switches
- 7. The Challenges • Different vendors different log formats. • Regulatory Requirements. • Logs were written by developers • Format is not easy to read • Messages can be obscure • Logs contain enormous amount of information. • Identifying anomalies can be difficult • Logs can be overwhelming • Amount • format
- 8. Best Practices • Develop logging Policy • Determine what information is relevant to you. • What devices are important? • What events are important? • Don’t forget to turn on logging! • Timing of events, e.g. user logons in morning. • What reports you and the business want/need? • Group servers into zones based on their function or criticality and priorities events accordingly.
- 9. Best Practices • Baseline your systems & network. • Determine how your network normally behaves. • Repeat at regular intervals • Secure log files on all devices. • Encrypt logs if possible • Ensure all devices use same time source. • If using more than one time zone use UTC. • Use NTP protocol from a secure source to synchronize time
- 10. Best Practices • Centralize log collection • Dedicated server to collect all logs. • Be careful of network traffic volumes. • Be aware of limitations of server to process number of events. • Configure all devices send logs to central log server. • Make sure central server is secure. • Secure transmission of logs. • e.g. Syslog uses UDP by default. Consider using IPSec or next generation Syslog (Syslog-NG)
- 11. Best Practices • Normalize the data • All events such asWindows, Syslog, SNMP etc. should be normalized into same format. • Review the Logs • Ensure logs are regularly reviewed • Manually • Automatically • Scripts • CommercialTools • FreewareTools
- 12. Best Practices • Log Retention • Based on disk space. • May be regulatory requirements. • Archive ontoWORM type devices and store in secure area. • Log Rotation • Determine time schedule • Based on volume of data • Develop meaningful naming convention. • Move data to rotated file
- 13. SIEM • Set ofTools,Applications and Correlation searches. • Built on top of Log Management Solution. • real-time analysis of security alerts, events and logs • continuous monitoring of all ongoing events • Alerts once incident is found • Helps in showing security posture • Facilitates discovery of security problems and breaches • Investigations
- 14. • Inbound/outbound suspicious activities • Event correlation for advanced threats • DDOS attacks • Unauthorized remote access • Critical service monitoring • Malware monitoring • IP Reputations • Risk & Compliance • SecurityThreats analysis