Protecting a corporate data center is like trying to keep an elephant safe from a swarm of flies. Despite your best efforts, bites happen.
As the staples of security-such as firewalls, antivirus software, spam and spyware filters-come together in suites of products that allow for sophisticated management, there are other security tools either emerging or worth a rethink.
Don’t Get Logrolled
One of the biggest problems CSOs face is figuring out what’s actually threatening their data center. Antivirus software, firewalls and intrusion-detection systems can log massive amounts of data about who is trying to do what to your data center. Just tracking it across different software programs-and across departmental systems-presents a vexing challenge, says James Quin, senior research analyst for the Info-Tech Research Group of London, Ontario.
“For organizations to parse through and then correlate and cross-reference all that data is a ridiculous amount of work and very labor-intensive,” Quin says. He recommends log analyzers, also known as security information managers (SIMs) and security information and event managers (SIEMs), that can aggregate data from a variety of systems. Such tools allow for centralized correlation and management of logs, and usually come with reporting and analytics tools.
ArcSight. is an example of such a tool that would work best for businesses that track large quantities of log data or want lots of features.
ArcSight is kind of a “Swiss army knife for logs,” says Dennis Hein, senior information security engineer with Wells Fargo in San Francisco. He uses the product to meld together all the bank’s system logs into one place. This saves him from tracking down anomalies, he says. “Things that would take days to investigate we can do in a matter of minutes and hours,” Hein says, because the tool can be set to produce well-formatted reports.
For smaller firms or those with less-customized needs, TriGeo from TriGeo Network Security and Symantec’s Security Information Manager aren’t as robust as ArcSight, but they are simpler to use, especially for firms without particular security expertise. Another practical reason for using log aggregators: They can stop smart attacks. “If you’ve got someone coming through who knows how to do it, an attack may raise a succession of yellow flags, but no red ones,” says Mike Halperin, vice president of technology at Akibia, a Westborough, Mass., consultancy specializing in data centers. Expose Your Weaknesses
The CSO’s version of introspection involves searching within the data center to look for weaknesses. For this process, consider vulnerability assessment and management tools like eEye Digital Security’s Retina vulnerability scanner, GFI LANguard’s vulnerability scanner with patch management and security auditing, or Qualys, a relatively simple to use Web-based tool for companies that may not have security staff with relevant skills.
County Bank, a 40-branch bank based in Merced, Calif., runs an AS/400 and about 40 PC servers and uses Qualys to conduct regular scans on the servers.
“Having a tool like this is extremely important,” says Charlie McClain, information security officer at County Bank. “The vulnerability picture in the Windows environment changes on a daily basis.” He likes Qualys because it keeps up with those vulnerabilities, meaning he does not have to.
In addition to scanning the Windows servers daily, County Bank scans its AS/400 once a month.
Also on the market is Nessus, the open-source vulnerability scanner that is no longer included in the BackTrack CD because of kernel compatibility issues.
It’s important to scan frequently. “Scan every 24 hours, looking for the silly human mistakes people make,” says Ken van Wyk, founder and principal consultant at KRvW Associates, an Alexandria, Va.-based security consultancy. He says that changes in applications, configurations, servers or the network can accidentally open vulnerabilities as a side effect and need to be spotted early.
CSI Data Center
Vulnerability scanners are perhaps the best-known computer-forensics tools. Forensics tools range from basic log scanners to very elaborate programs that can examine the guts of your system at a deep level. The skill and technical knowledge needed to run these tools varies greatly. Serious forensics analysis is a job for experts, but just about anybody can use other simpler analysis tools, although interpretation may require special knowledge. Every CSO should have at least some basic forensics tools to use in the data center.
Perhaps the best example is the BackTrack 3 CD. The BackTrack 3 CD (www.remote-exploit.org/backtrack.html), a live CD containing a collection of open-source forensics tools. “One thing someone [who is handling data center security] should do is download BackTrack 3 CD, learn how to use it and learn how to create visibility into their network environment,” says John Kindervag, a senior analyst at Forrester Research.
Plug the Leaks
Software that monitors the data that leaves the data center and attempts to prevent the inappropriate export of sensitive data is called data-leakage-protection software. Other names for this fairly new area are data loss prevention (DLP), information leak detection and prevention (ILDP), information leak prevention (ILP), content monitoring and filtering (CMF) or extrusion prevention system.
Data-leakage protection uses software that monitors what goes out of the data center and attempts to prevent the inappropriate export of sensitive data. It is attracting a lot of attention as companies shift focus from strict concentration on threats coming in, to what’s going out of their organizations. “Protecting data by making sure it doesn’t exit the company inappropriately is the key,” says Quin, adding that data leakage protection is “outside the norm as it stands now but certainly something that has a great relevance to every organization.”
Most of the companies in the DLP market were startups, but in the last six to nine months the big security vendors have snapped up many of the independent players in the space. Symantec now has Vontu, RSA has Tablus (now part of the RSA Data Loss Prevention Suite) and McAfee has Reconnex, he notes. “The combination of these tools backed by larger, richer and capable organizations puts these tools and these companies in a leadership position,” Quin says.
Other considerations are the size of the company and the resources you have to devote to security. Quin says there are several areas where the most capable product isn’t necessarily the best one for small and midsize businesses; in every case, CSOs will have to evaluate functionality versus constraints such as price and manpower requirements.
You Must Comply
Controlling access is a core aspect of data-center security management. Identity-management systems that can be set to control what legitimate users can access are now well-established, with tools like IBM’s Tivoli ID Manager and Access Manager and competing products from Oracle, BMC, CA and Novell.
But an emerging part of access management is policy compliance management, which uses security policies to control access to resources, rather than looking at individual identities. Symantec’s BindView and Elemental Security’s Elemental Security Platform are examples.
Remember that one aspect of data-center security is that many of the tools have overlapping functions and feature sets. One analyst’s log analysis tool is another’s security information manager, for instance. That’s likely to continue as vendors try to beef up their product lines.
The security benefits of <a href=
