Home » Data Protection » Network Security

Data Center Security Tools to Not Overlook

Endpoint technologies and virtualization software get a lot of ink these days, but here's a quick look at five other key security areas addressed by data-center tools

October 09, 2008 — CSO — Protecting a corporate data center is like trying to keep an elephant safe from a swarm of flies. Despite your best efforts, bites happen. As the staples of security—such as firewalls, antivirus software, spam and spyware filters—come together in suites of products that allow for sophisticated management, there are other security tools either emerging or worth a rethink.

Don't Get Logrolled
One of the biggest problems CSOs face is figuring out what's actually threatening their data center. Antivirus software, firewalls and intrusion-detection systems can log massive amounts of data about who is trying to do what to your data center. Just tracking it across different software programs—and across departmental systems—presents a vexing challenge, says James Quin, senior research analyst for the Info-Tech Research Group of London, Ontario.

"For organizations to parse through and then correlate and cross-reference all that data is a ridiculous amount of work and very labor-intensive," Quin says. He recommends log analyzers, also known as security information managers (SIMs) and security information and event managers (SIEMs), that can aggregate data from a variety of systems. Such tools allow for centralized correlation and management of logs, and usually come with reporting and analytics tools.

ArcSight is an example of such a tool that would work best for businesses that track large quantities of log data or want lots of features.

ArcSight is kind of a "Swiss army knife for logs," says Dennis Hein, senior information security engineer with Wells Fargo in San Francisco. He uses the product to meld together all the bank's system logs into one place. This saves him from tracking down anomalies, he says. "Things that would take days to investigate we can do in a matter of minutes and hours," Hein says, because the tool can be set to produce well-formatted reports.

For smaller firms or those with less-customized needs, TriGeo from TriGeo Network Security and Symantec's Security Information Manager aren't as robust as ArcSight, but they are simpler to use, especially for firms without particular security expertise.

Another practical reason for using log aggregators: They can stop smart attacks. "If you've got someone coming through who knows how to do it, an attack may raise a succession of yellow flags, but no red ones," says Mike Halperin, vice president of technology at Akibia, a Westborough, Mass., consultancy specializing in data centers.

Expose Your Weaknesses
The CSO's version of introspection involves searching within the data center to look for weaknesses. For this process, consider vulnerability assessment and management tools like eEye Digital Security's Retina vulnerability scanner, GFI LANguard's vulnerability scanner with patch management and security auditing, or Qualys, a relatively simple to use Web-based tool for companies that may not have security staff with relevant skills.