by Oshan Indika
Every day, security professionals are overwhelmed by the number of incidents they must manage. When you look at the ever-increasing number of systems and devices in an enterprise, it’s clear why events originating from all these sources can cause information overload. And, if you don’t use the correct tools to manage this information, you can miss critical events and possibly compromise the confidentiality, integrity, and availability of the data you’re trying to protect.
What exactly is an incident? According to the International Information Systems Security Certification Consortium (ISC)2 (www.isc2.org):
A security incident is an adverse event or series of events that adversely impacts the security or ability of an organization to conduct normal business.
This definition introduces another important term: event. An event is simply an observable occurrence—an aspect that can be documented, verified, and analyzed.
The most important thing to understand from the definition is that several events—perhaps from different sources (systems, devices)—can be part of a broader security incident. The ability to correlate events to an incident is one of the most important functions of a SIEM (Security Information and Event Management) tool. Other major functions are consolidation (of logs), notification (e-mail, pager, SMS), and reporting.
To understand the importance of the big picture from an enterprise point of view, let’s look at a sample of events from multiple sources:
- Exit point monitoring software on the System i reports a rejected FTP remote command attempt
- QAUDJRN reports invalid sign-on attempts on QSECOFR via Telnet
- The IDS (Intrusion Detection System) in the perimeter firewall reports attempts to access the System i IP address on the FTP and Telnet ports
- Abnormal traffic patterns inbound and outbound on a Windows server on FTP and Telnet ports
If you look at these events individually, it’s difficult to identify whether anything is happening. And, if you happen to connect them later, it may be too late. But, when you use a SIEM tool, you see the link between the events and understand that they are part of a single security incident: Someone is trying to access a critical server (the System i) from the perimeter and is targeting it from a compromised Windows server.
This incident contained just four events–imagine isolating those four events out of the thousands that occur across your enterprise every day. And, if each team (Windows, System i, firewall, and so on) investigates these events in isolation, it would take considerable time and resources to come to the correct conclusion.
This is why each critical system and device in the enterprise should escalate security events to a centralized server managed by a SIEM tool. Many SIEM tools provide a syslog server to consolidate events from various systems (Windows, Unix, Linux) and devices (routers, switches, firewalls). This syslog method of collecting log information has become the de facto standard in the industry. In fact, many vendors, including ArcSight, Symantec, TriGeo, LogRhythm, Loglogic, and Kiwi, offer a syslog-based interface to gather event information from various sources.
From a System i point of view, it is vital that important security events be pushed to a syslog server on a real-time basis and be part of the bigger picture of enterprise security information. Powertech’s Interact lets you escalate security-related events from the System i to a syslog server. You can even filter these events by user, IP address, day, and time, and assign them a criticality value to control the amount of data sent to the server.
You can use Interact to:
- Send events from the System i security audit journal (QAUDJRN). These events include changes to user profiles and system values; invalid login attempts; objects that are changed, deleted, moved; intrusions detected, and more.
- Capture and send critical operating system messages from QSYSOPR or QSYSMSG by monitoring for critical events such as Critical storage threshold reached or Profile disabled due to invalid logins.
- Include all allowed and rejected transactions from PowerTech Network Security to monitor network access to the server through FTP, ODBC, and Remote Command.
It’s time for the System i to become part of the enterprise view, rather than an island of security information. Interact is the solution that helps the System i become part of the big picture!
Oshan Indika has over 12 years of IT experience in enterprise infrastructure management, including system administration on a variety of platforms, (System i [AS/400], Windows, UNIX, Linux, and Solaris); LAN/WAN network administration (frame relay); and security firewalls.
He is a Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA). Previously, he held CCNA and MCP certifications in network and systems management.
Oshan works as a Technical Consultant for Help/Systems International in the Asia-Pacific office.
