A few weeks ago we wrote about CERT and the "13 best practices for preventing and detecting insider threats." One of the recommendations is to log, monitor, and audit employee online actions. The logic is that logging, periodic monitoring, and auditing provide an organization the opportunity to discover and investigate suspicious insider actions before more serious consequences ensue.

No company wants to cast suspicions on its own trusted workers, but the fact of the matter is that insider threats are on the rise. Some of the factors which exacerbate the insider threat are:

• The rise in number of high risk users with broad network access including super-users, contractors, consultants and partners.
• The complexity and growth of different information assets.
• The access blind spots that exist due to provisioning errors and silos of isolated application access controls.

Controlling and protecting an organization’s information assets is a layered approach that covers the gambit of everything from perimeter defense down to user privilege control. At the core of any IT architecture are the associated audit/transaction logs that can provide invaluable insight into individual activities, be they legitimate or subversive.

These logs contain valuable information that, if accessible, can detect serious impending system problems and security violations before they impact the organization. But it is a challenge to view event logs one system at a time and make sense of them. Log message formats vary widely from system to system, and many of the conditions that indicate issues can only be detected when events are correlated with events happening on other systems and devices.

The term “event log management” sometimes seems like an oxymoron. By the time you combine the sheer quantity of arcane event data generated by complex infrastructures with the requirement to meet compliance regulations (Compare Network Auditing and Compliance products) and then add the always pressing mandate to further guarantee information security, the ability to successfully manage events seems a very distant and, often, a very lofty goal.

Collecting, storing and making sense from event logs present significant challenges. Administrators ask the following questions on a daily basis:

Linda Musthaler is a principal analyst with Essential Solutions Corporation.