The advent of the Internet and surrounding technology has opened up many opportunities for businesses that are willing to take risks and embrace the e-revolution. This revolution has changed the way we do business and companies around the world are being forced to find new and innovative ways of conducting their business online.The adoption of the online business model presents a wealth of opportunities and cost savings to an organisation, but at the same time introduces it's own unique set of problems. Possibly one of the biggest challenges that an organisation must overcome with regards to online business is security.
The security challenge is multi-faceted and complex, with dire consequences if it is not properly addressed. Threat Management is one aspect of security that requires careful consideration, taking in to account the plethora of options available, including IDS, auditing and logging systems, and alerting services.An effective threat management strategy will enable a company to respond proactively, allowing them to mitigate potential threats as they arise. However, more often than not, the systems implemented to assist companies in assessing and mitigating these threats, tend to provide an overwhelming volume of information (and many false alerts), reducing the overall effectiveness of the system. In addition, the technical solutions tend to be complex to install and maintain, increasing the strain on corporate security teams.
Quality information that can be delivered on time is key to any security system, particularly a threat management system. There are currently a myriad of ways to gather intelligence for a threat management system, ranging from manual trawling of web sites to automated news feeds and mailing lists.It is only through the combination of security tools, intelligence, and acting proactively that a company can begin to survive the attacks against their online business.
Many larger businesses have dedicated resources whose primary responsibility is to scour the Internet for the latest threats relating to the organisation. These teams have to sift through information provided by recognised vulnerability alerting services such as CERT, BugTraq, UNIRAS, X-Force and SANS to name a few. They also keep track of the vendor's web sites as well as a variety of news groups and perhaps even certain underground hacker sites. After having gathered all of this information, these teams have to sort through it, classify it according to the source, validity and impact and discard all information that is not related in some way to the organisation, finally feeding the relevant alerts to the responsible persons within the company.
