Top 10 tips for unifying security and IT operations

The emergence of Enterprise 2.0 with social, mobile, local, and cloud applications within the enterprise have increased IT operational challenges. Other trends such as bring your own device (BYOD) are adding new dimensions that are challenging for IT Operations due to diversified form, OS, vendors, etc. Your customers and employees are demanding an open platform to facilitate better collaboration. However, your IT operations may not be in position to support Enterprise 2.0 or BYOD due to security challenges or resource constraints. So, how do you align your business requirements and IT resources, while keeping it secure?

 

problems.png

 

In many organizations, security operations work in siloes to IT Operations. As a result, security vulnerabilities have to be handled twice: once by the security operation center (SOC)  groups or security teams; and secondly by the IT Operations team who could not initially identify the issue. Consequently, you cannot establish any automation for information sharing or event correlation between security vulnerabilities and performance issues. Let us see how some of these automation challenges can be addressed between security and IT Operations.

 

soc-noc collaboration.png

 

Here are the top 10 tips to unify the security and IT operations:

 

  1. Centralized approach: You can act only if you understand the problem, you can understand only if you can see the problem. So, you cannot secure it you cannot see it. How do you get visibility into all the problems in your IT? Having a centralized approach to manage the big data. Avoid patch solutions to fill gaps in your IT security. Don’t rely on point vendors to help you with your IT issues. The complexity of the problem increases with multiple point solutions. Look for single vendor with seamlessly integrated tools.
  2. Consolidated view: Get a consolidated view of IT security, IT Governance, Risk, Compliance (GRC), and IT operations data. There are executive dashboards for each of them in the market; however, it is important to get a consolidated view of the entire IT aligning with your overall business.
  3. Comprehensive log management: Avoid using tools reduce the number of events to avoid false positives or limiting the breadth and depth of data collection. With the emerging trends and explosion of data, you need to collect everything and analyze each log or event. So, use comprehensive log management solutions to manage your entire IT. Log management tools not only collects every log from all log generating sources but also helps to store the events for a long time after filtering and parsing.
  4. Security based event correlation: There are many event correlation tools with IT operations, however you need security focused event correlation engine. It is important to connect users with roles, responsibilities, access controls, and trends to answer questions such as who did what? When? And how?
  5. Network security: An IT operation has network monitoring tools. Security Ops also has security tools such as intrusion prevention system (IPS), however you need tools that integrate and augment these tools with log management and event correlation capabilities. Change management poses risk within network that can be mitigated and checked with these comprehensive log management tools integrated with network security tools.
  6. Application security: Develop threat immunity through the development of applications. There are tools that can help you test your code for security vulnerabilities. If you are outsourcing or using 3rd party apps then there are tools to test the apps vulnerabilities as well. At least, if you cannot perform these tests through automation, you should at least do a manual QA of apps from a security viewpoint to ensure app security.
  7. Network and applications security intelligence: Adding digital vaccination to IPS tools as described earlier, through a threat reputation database keeps your network and apps updated with the latest known threats in the market. It is like updating your laptop security software except it has database of every known threat and configuration change of every network component.
  8. Unified data: The amount of data you handle will increase exponentially. The more security and network devices you add, you only create more data. So, you need to make sure that you need to unify the entire log data that you collect in various formats into a single format. This helps you to use the same unified data for searching, indexing, reporting, analyzing, and archiving the log and event data.
  9. Simplify un-structured data: You are going from suppressed structured data into collecting and analyzing every single data for security breach using IT ops tools. This demands simplifying the handling of un-structured data. Data unification anyway helps you to keep all data in a simple flat file, enriched with metadata. Having a simple search tool enhances the user experience.
  10. Resource optimization: Share tools, knowledge, and talent pool. These three will help you train larger pool of IT people on both SOC and NOC tasks. You not only build domain expertise, but also keep the talent pool well trained in case of attrition. If you follow the first nine tips, you could easily rotate jobs of IT managers in your organization and make them excited to work in your IT organization.

 

 

 

Start building your SOC center or integrating your existing SOC with the NOC through log management solution. Get your free trial copy of HP ArcSight Logger, the universal log management solution from HP.

 

Related links:

www.hp.com/go/logger - Download trial version of HP ArcSight Logger

www.hpenterprisesecurity.com/logger  - For more product info on HP ArcSight Logger

Comments
Sietai | ‎09-10-2012 01:04 AM

Awsome post. Very informative. Thanks

Leave a Comment

We encourage you to share your comments on this post. Comments are moderated and will be reviewed
and posted as promptly as possible during regular business hours

To ensure your comment is published, be sure to follow the Community Guidelines.

Be sure to enter a unique name. You can't reuse a name that's already in use.
Be sure to enter a unique email address. You can't reuse an email address that's already in use.
Type the characters you see in the picture above.Type the words you hear.
Search
Showing results for 
Search instead for 
Do you mean 
About the Author
Featured


Follow Us
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.