Data-center security tools to not overlook

Protecting a corporate data center is like trying to keep an elephant safe from a swarm of flies. Despite your best efforts, bites happen. As the staples of security -- such as firewalls, antivirus software, spam and spyware filters -- come together in suites of products that allow for sophisticated management, there are other security tools either emerging or worth a rethink.

Don't get logrolled

One of the biggest problems CSOs face is figuring out what's actually threatening their data center. Antivirus software, firewalls and intrusion-detection systems can log massive amounts of data about who is trying to do what to your data center. Just tracking it across different software programs-and across departmental systems-presents a vexing challenge, says James Quin, senior research analyst for the Info-Tech Research Group of London, Ontario.

"For organizations to parse through and then correlate and cross-reference all that data is a ridiculous amount of work and very labor-intensive," Quin says. He recommends log analyzers, also known as security information managers (SIMs) and security information and event managers (SIEMs), that can aggregate data from a variety of systems. Such tools allow for centralized correlation and management of logs, and usually come with reporting and analytics tools.

ArcSight is an example of such a tool that would work best for businesses that track large quantities of log data or want lots of features.

ArcSight is kind of a "Swiss army knife for logs," says Dennis Hein, senior information security engineer with Wells Fargo in San Francisco. He uses the product to meld together all the bank's system logs into one place. This saves him from tracking down anomalies, he says. "Things that would take days to investigate we can do in a matter of minutes and hours," Hein says, because the tool can be set to produce well-formatted reports.

For smaller firms or those with less-customized needs, TriGeo from TriGeo Network Security and Symantec's Security Information Manager aren't as robust as ArcSight, but they are simpler to use, especially for firms without particular security expertise.

Another practical reason for using log aggregators: They can stop smart attacks. "If you've got someone coming through who knows how to do it, an attack may raise a succession of yellow flags, but no red ones," says Mike Halperin, vice president of technology at Akibia, a Westborough, Mass., consultancy specializing in data centers.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email CIO
• Follow CIO on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark