Me vs. Mike Rothman: Could I Possibly Win?

Let me start by saying that Mike Rothman is something of an infosec sage, and has the kind of resume in this field that only dozens of other people have. When he was a VP at META Group (now Gartner), I was still camping out for jsbx tickets. (OK, I was also working on this Linux HOWTO on proxy firewalls, too. But I was then and pretty much still am a nobody.) So, it is with all due respect that I am picking on an article that Mr. Rothman wrote for SearchSecurity.com. Also, to answer the question posed in the title, no, no I stand zero chance.

"Plagued by expensive and integration-heavy implementations, SIM products and vendors have never lived up to their promise, taking millions of venture capital with it."

Mike doesn't seem to be impressed with the current SIM offerings. And, to be fair, it's not all good news. Some SIM products are weak, some are expensive, and some are both, and maybe some are neither. What a SIM needs to work is access to your logs. That's pretty easy to deliver in most cases either via syslog, WMI, flat file access, SNMP, and so on. Not much integration.

"Just think: How great would it be to look at one screen, or one dashboard, and be able to pinpoint problems, maybe even before they occur?"

Hellz yeah! But be real. No vendor can drop that in your lap. Or, if they can, you probably also live in a 3-bedroom house with a white picket fence, 2.6 kids, and a dog, Mr. Generic. Let's not bag on the vendors because they don't deliver the moon. SIM is a tool, and you're going to learn how to use it or you're going to hate it.

"One problem is the overactive nature of SIM; its inputs, like firewalls and IPS devices, are inherently noisy. If the inputs are rife with false positives, it has historically been difficult for SIM offerings to provide actionable information without a tremendous amount of experimentation and tuning."

This is a straw man. If the original data is flawed, then the analysis of that data will yield flawed results. I don't see how that's the fault of your SIM product. But Mike does have a good point - tune your IDS already. It's 2007.

"Also, SIM products seem to address problems after it's too late; by the time information is correlated from log files, the attack has already happened. "

Another straw man from the Gartner IDS/IPS debate. Yeah, it sucks how SIM doesn't do something it wasn't designed to do. Actually, what sucks more is that vendors are taking this idea to heart and trying to make SIM act as an IPS, too.

"And in today's environments, where attacks can proliferate throughout the world in a matter of minutes, playing catch-up can be crippling."

This is the sentence that inspired me to post a response to Mike's article. SIM isn't there to stop attacks from happening. It's not a defensive tool, it's an analysis tool. This makes it ideal for incident response. Something bad has happened, and if all of your logs are in one place, you have a great tool for organizing and searching for related evidence, defining the scope of the response, and monitoring post-response activity.

" First, security management is increasingly being integrated with network behavior anomaly detection (NBAD), providing pseudo real-time visibility into what's happening on your network."

I agree with Mr. Rothman that analyzing netflow is a good idea. Being able to access that data from inside your SIM is an even better idea. The problem is that logging netflow with a ratio of one event (one row in your database) to each unique connection presents serious throughput and storage issues. So this is where SIM vendors should get to work integrating with FlowCollector, NetworkVantage, and other netflow collector/analyzer products. I know that some SIM vendors are going to bundle this functionality, but a SIM interface into the third-party product data is much more elegant and practical in my book than having the SIM do the netflow collection itself. I think the horse has already left the barn here, though.

I have two more random points that I want to make on the topic of SIMs and their role in security. These aren't in direct response to Mike's article, but I think they're worth bringing up here.

First, it seems that SIM products are getting pigeonholed as consoles for IDS and other network data. This is a very narrow view of what SIM can do. In fact, I would say there's more value in operating system and application logs. I know from some of the other companies I've talked to that there are SIM installs out there that do nothing but application logs. That's very cool.

Second, there's a lot of innovation in the SIM market right now, and it comes in places security folks often don't look first. Some of the coolest GUI design work that I've seen outside of windowing environments has been in the SIM arena.