Schneier on SIMS
Bruce Schneier has written a blog on his view of SIMS.
I agree mostly with Schneier’s view on the current SIM space. I agree that log analysis can provide a gold mine of information to IT groups. I also agree that log analysis works, regardless whether or not you use a SIM product. As Schneier said in the blog, there’s also a lot of hype in the current SIM space.
However, The SIM space is only 4-5 years old, much of the technologies and ideas are still being developed. Faster and more intelligent solutions are still to come. Even though I agree that having human intelligence behind a SIM solution (product or service) is better than an all-technology solution, I have to disagree with Schneier in that people is the only solution. I also disagree that SIM products don’t help enhancing the security of the network.
The best solution is a combination of people and technology.
Much of what’s in the SIM products these days are based on human intelligence. Human intelligence remains inside a human brain mainly because there’s no easy way to express the process/steps/procedures into algorithms.
People are better at identifying patterns that have not been seen before. But once the pattern is identified and can be expressed in computer’s language, the computer can do a much faster job of identifying the same patterns. As computers are programmed to detect more and more existing patterns, the people are freed to identify new patterns. This is a process (cycle) in which human and machine can work together and provide the best solution.
The SIM products enables this process. SIM products provide tools for the people to express patterns to the computer and take over the job of detecting those patterns. The SIM products also enables people in identifying new patterns quicker. For example, a graph of past day’s events can show spikes in usage, or other anomalies. If a human were to just go through the logs, she may have missed some of events.
SIM products have their places, we just need to use them correctly and not expect that by installing a SIM product, all your problems are solved.
Disclaimer: This is my personal blog. The opinions expressed in this blog are the views of the writer and do not necessarily reflect the views and opinions of VMware.