BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Logs – A Gold Mine of Information

Posted May 4, 2011    Peter McCalister

In an earlier post I talked about tapping in to the power of the information in our privileged identity management system to improve productivity. Those detailed compliance logs you have been generating are a gold mine of information.

Analyzing large amounts of data is a growing trend. From Google to WalMart companies are building their strategies on complex models and algorithms.

Systems logs can be used not just to look for patterns that indicate a security threat, but those same patterns can show where security and other procedures such as improper configurations of new systems are hurting productivity. Finding those patters can help uncover opportunities to better train, simplify procedures, and uncover best practices that not everyone is following. And once those best practices are discovered you can use controls to ensure that best practices are being followed.

Realizing that value requires a data analysis strategy and a strategy for how to engage the organization in using that analysis. Your data analysis strategy needs to consider the roles of monitoring, logging and reporting, as well as when and how to combine data from different sources. Single silos of data are simpler to use but correlating data across silos provides more powerful insights. Ultimately you will need both, but your data analysis strategy needs to focus on providing insights your organization can act on. And that’s where you need to consider your how to engage your people in using the data. More on that next week.

Leave a Reply

Additional articles

normal-blog-img

New IT Security Best Practices for Maintaining “Business as Usual” Despite Evolving Threats

Posted August 13, 2014    Morey Haber

It’s time to get back to business. Here in the U.S., summer vacations are wrapping up and businesses are looking forward to closing out 2014. Over the past year, we’ve seen several incidents that warrant changes in the ways consumers make purchases and businesses conduct transactions. Consider last week’s theft of a whopping 1.2 billion…

Tags:
, , ,

Retina Vulnerability Audits – August 2014 Patch Tuesday

Posted August 12, 2014    BeyondTrust Research Team

The following is a list of Retina vulnerability audits for this August 2014 Patch Tuesday: MS14-043 - Vulnerability in Windows Media Center Could Allow Remote Code Execution (2978742) 34924 – Microsoft WMC Remote Code Execution (2978742) MS14-044 - Vulnerabilities in SQL Server Could Allow Elevation of Privilege (2984340) 34915 – Microsoft SQL Server Multiple Vulnerabilities (2984340) – 2008 34916 –…

patch-tuesday

August 2014 Patch Tuesday

Posted August 12, 2014    BeyondTrust Research Team

This August Microsoft has released nine security bulletins which account for a whole variety of critical vulnerabilities. The most critical bulletins are MS14-051 (Internet Explorer), MS14-045 (Kernel-mode), and MS14-049 (Windows Installer). MS14-043 fixes a critical code execution vulnerability within Windows Media Center (people still use that?). The vulnerability itself is specifically within a COM object…

Tags:
, , ,