Alien-Sec New Security Boundaries

---

File Tracer - File system monitoring is an essential process that allows for information about changes or actions in the monitored file system or folders.

Each file system is monitored and documented by the operating system manufacturer or third-party software manufacturers, for example: Alien-Sec, SolarWinds, ManageEngine etc.

With this kind of software you can get:

• File System Log collection
• Centralized File System log aggregation
• Long-term log storage and retention
• Log rotation
• Log analysis for each change that occurred (in real-time and in bulk after storage)
• File System Log search and reporting.
• File System Anomaly Events.

Contents

 [[null hide]]

• 1 Overview
• 2 Deployment life-cycle
• 3 See also
• 4 References
• 5 External links

Overview

The primary drivers for log management implementations are concerns about security, system and network operations (such as system or network administration) and regulatory compliance. Logs are generated by nearly every computing device, and can often be directed to different locations both on a local file system or remote system.

Effectively analyzing large volumes of diverse logs can pose many challenges, such as:

• Volume: log data can reach hundreds of gigabytes of data per day for a large organization. Simply collecting, centralizing and storing data at this volume can be challenging.
• Normalization: logs are produced in multiple formats. The process of normalization is designed to provide a common output for analysis from diverse sources.
• Velocity: The speed at which logs are produced from devices can make collection and aggregation difficult.
• Veracity: Log events may not be accurate. This is especially problematic from systems that perform detection, such as intrusion detection systems.
• Accuracy: Log events that are very accurate. The recorded information is rich in details that build an accurate description of the documented case, for example: File Tracer.

Users and potential users of log management may purchase complete commercial tools or build their own log-management and intelligence tools, assembling the functionality from various open-source components, or acquire (sub-)systems from commercial vendors. Log management is a complicated process and organizations often make mistakes while approaching it.

Suggestions were made^{[by whom?]} to change the definition of logging. This change would keep matters both more pure and more easily maintainable:

• Logging would then be defined as all instantly discardable data on the technical process of an application or website, as it represents and processes data and user input.
• Auditing, then, would involve data that is not immediately discardable. In other words: data that is assembled in the auditing process, is stored persistently, is protected by authorization schemes and is, always, connected to some end-user functional requirement.

Logging can produce technical information usable for the maintenance of applications or websites. It can serve:

• to define whether a reported bug is actually a bug
• to help analyze, reproduce and solve bugs
• to help test new features in a development stage

Deployment life-cycle

One view^{[citation needed]} of assessing the maturity of an organization in terms of the deployment of log-management tools might use^{[original research?]} successive levels such as:

1. In the initial stages, organizations use different log-analyzers for analyzing the logs in the devices on the security-perimeter. They aim to identify the patterns of attack on the perimeter infrastructure of the organization.
2. With increased use of integrated computing, organizations mandate logs to identify the access and usage of confidential data within the security-perimeter.
3. At the next level of maturity, the log analyzer can track and monitor the performance and availability of systems at the level of the enterprise — especially of those information-assets whose availability organizations regard as vital.
4. Organizations integrate the logs of various business-applications into an enterprise log manager for better value proposition.
5. Organizations merge the physical-access monitoring and the logical-access monitoring into a single view.

See also

• Audit trail
• Common Base Event
• Common Log Format
• DARPA PRODIGAL and Anomaly Detection at Multiple Scales (ADAMS) projects.
• Data logging
• Log analysis
• Log management knowledge base
• Security information and event management
• Server log
• Syslog
• Web counter
• Web log analysis software

External links

• ShadowRDP Remote Control Tool for Easy Terminal Environment Sessions Control and Support
• File Tracer - Monitor Multiple Folders for Any Changes, Automatically Create Events in Windows Event Log

References

• Jump up^ http://csrc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf
• Jump up^
• Jump up^
• MITRE: Common Event Expression (CEE) Proposed Log Standard. Online at http://cee.mitre.org, retrieved 2010-03-03
• NIST 800-92: Guide to Security Log Management. Online at http://csrc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf, retrieved 2010-03-03

This article "Alien-Sec New Security Boundaries" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Alien-Sec New Security Boundaries. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

---