.

Security Dashboard

<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Mon Apr 05, 2010 6:12 am

Security Dashboard

Has anyone ever had to do one of these?

Essentially, I am tasked with:  creating a snapshot that shows all aspects of security health that can be easily understood at the Exec level.

If anyone knows of any examples, ideas or suggestions I would greatly appreciate it.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

ziggy_567

User avatar

Sr. Member
Sr. Member

Posts: 378

Joined: Tue Dec 30, 2008 1:53 pm

Post Mon Apr 05, 2010 8:40 am

Re: Security Dashboard

Have you taken a look at:

http://www.sans.org/security-resources/ ... f?ref=3766

Also, if your collecting network traffic, its always nice to see things like workstations/endpoints creating the highest traffic volume, workstations that are utilizing banned protocols, etc. etc.


--
Ziggy
--
Ziggy


eCPPT - GSEC - GCIH - GWAPT - GCUX - RHCE - SCSecA - Security+ - Network+
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Mon Apr 05, 2010 9:55 am

Re: Security Dashboard

Thanks, Ziggy.  I think I will include charts, graphs and pictures since execs seem to like those better and can be a better point of reference than wording.  But, I will have captions as well so it has substance. 
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Mon Apr 05, 2010 10:09 am

Re: Security Dashboard

In my experience, execs like to see security related to dollars.  They react better when you are prepared to tell them:

a.  how much is it going to cost us?
b.  what is the potential cost if we don't do this?

I think that if you put security in the terms of risk analysis, they will respond better to your presentation. 

I think that charts and graphs are an excellent idea, especially if they rating the security issues in terms of cost, risk, and impact.

These are just my two cents.
~~~~~~~~~~~~~~
Ketchup
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Mon Apr 05, 2010 8:01 pm

Re: Security Dashboard

Have you tried Splunk? I guess it would depend on the size of your organization if it would remain free, but here's a link that may help:

http://www.splunk.com/base/Documentatio ... boardIntro

Don
CISSP, MCSE, CSTA, Security+ SME
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Tue Apr 06, 2010 7:38 am

Re: Security Dashboard

Downloading now, Don.  I put your site and you as the person who referred me to this solution.

Thanks to you as well, Ketchup!  Good ideas to go off of.  I am going to start this today and see how it goes.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Tue Apr 06, 2010 10:43 am

Re: Security Dashboard

Dengar13,

Please let us know what you think of Splunk. I had it at work, but the company wouldn't pay for the full version, thus usage was limited. Mainly it was used as a syslog tool for the NAS.

I didn't care for it, based on the limited function of it. When I took over the senior role, I dropped it and went with a proper syslog server in it's place.

I have heard other people speak good of it, require it for security related jobs, and I wonder what a full version would provide.
OSWP, Sec+
<<

ziggy_567

User avatar

Sr. Member
Sr. Member

Posts: 378

Joined: Tue Dec 30, 2008 1:53 pm

Post Tue Apr 06, 2010 11:47 am

Re: Security Dashboard

I can't believe I didn't think of Splunk. I use the free version of Splunk as well, but I love it!

We use it with syslog-ng on our Solaris/RedHat servers for our log server. We've also incorporated all our Cisco logging, and a few of our Windows servers (with Snare). We are soon to start incorporating Apache and Weblogic logs to our implementation.

Splunk is awesome!!! Its not so intuitive to configure, but its VERY intuitive to use through the GUI once setup. The commercial version is not that expensive (depending on how much throughput you need) to boot...

--
Ziggy
--
Ziggy


eCPPT - GSEC - GCIH - GWAPT - GCUX - RHCE - SCSecA - Security+ - Network+
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Tue Apr 06, 2010 11:55 am

Re: Security Dashboard

Roger that, chrisj.  I will be sure to do so when I have it set up and tuned the way I need it for my environment.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Fri Apr 16, 2010 2:27 pm

Re: Security Dashboard

Well, Splunk has been scrapped.  The cost is too high for us to use and I will have to find a clever way to do this and am thinking I may leverage what I already have internally.  Thanks for the help as always!
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Fri Apr 16, 2010 2:34 pm

Re: Security Dashboard

What about one of the ManageEngine products? I just happened to see an ad here on EH-Net for their helpdesk product (I actually implemented this in a prior position, price was very reasonable, much cheaper than competing products). They had a lot of different products, and I thought one or two was for overall network status that may have included security. Their stuff is very graphical and pretty :) and easy to use. I'll have to take a look at their products again, but I know they had a couple of security-related things.
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Fri Apr 16, 2010 2:35 pm

Re: Security Dashboard

Sweet....I will take a gander at that.  I appreciate that.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Fri Apr 16, 2010 2:36 pm

Re: Security Dashboard

http://www.manageengine.com/it-compliance-suite.html

Any of these do what you need?

No problem :)
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Fri Apr 16, 2010 2:40 pm

Re: Security Dashboard

WOW!  I'd say a couple of them would do the trick.  I will have to demo it and see what pricing is like.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Fri Apr 16, 2010 4:29 pm

Re: Security Dashboard

Cool, let us know how that works out. They were very accommodating of licensing for testing purposes when I worked with them.
Next

Return to Compliance, Regulations &amp; Standards

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software