White Paper: Log Management: How to Develop the Right Strategy for Business and Compliance
Current security monitoring approaches rely too heavily on the collection of data at the network layer, generating volumes of data and leaving the application layer at risk. Network monitoring can complement and enhance host and application-based monitoring, but rarely substitutes for it. After all, the typical end result of an attack is access to a host or application such as a credit card database. Host and application-based monitoring identify events that actually did occur, not what could occur. The combined analysis of network events with log data from critical applications and hosts can point to high risk activity that may be overlooked in network-only analysis.
This white paper helps security and IT executives design a strategy for more effective log management with a five step process: