IT Security is the name of the game and no matter how big or small the size of your organization, you will always invest enough on securing certain aspects of your IT network. In many organizations, it starts with monitoring your network for vulnerabilities that may enter the network to access potentially sensitive information in the form of security attacks.

For example, you may have firewalls as your first line of defense, followed by vulnerability management, intrusion detection and prevention systems, managing your network configurations and so on. 

 

These are crucial because:

• Your routers can be easily breached without proper configuration and restrictions. 
• If a firewall isn’t configured correctly, a hacker can easily spot a port that is accidentally left open and can gain access to the network. 
• Rogue access points, botnet malware and social engineering can make your wireless a porthole into your LAN.

Why Logs?

The very purpose of IT security is to be proactive and the above measures make it more difficult for someone who attempts to compromise the network. This might just not be enough and you need to able to detect the actual breaches as they are being attempted. This is where log data really help.

To expose an attack or identify the damage caused, you need to analyze the log events on your network in real-time. By collecting and analyzing logs, you can understand what transpires within your network. Each log file contains many pieces of information that can be invaluable, especially if you know how to read them and analyze them. With proper analysis of this actionable data you can identify intrusion attempts, mis-configured equipment, and many more. Also for managing compliance, especially for PCI DSS – you need to retain logs and review them.

Monitoring and Analyzing Event Logs

When you know what is normal on your network, you can easily spot what is abnormal by monitoring the logon activity. It is very critical to analyze the event to understand the root cause and to make log analysis & log management more efficient, you need to collect and consolidate log data across the IT environment, and correlate events from multiple devices in real-time.

Apart from monitoring the activities across your web server, firewalls and other network devices, it becomes very crucial to monitor your workstation logs. For example, a workstation log can give you some key information like when a USB was connected, by whom and whether he belongs to the group that is authorized, etc. Log file analysis is best done with an SIEM software, when it comes to reading all of the events and being able to analyze and correlate activity across the various components of IT.

How SolarWinds Log & Event Manager can help you?

SolarWinds Log & Event Manager (LEM) completely monitor event logs across and acts as a central collection point for system log data, automatically aggregates and normalizes this data into a consistent format. LEM also performs multiple event correlation and has the distinct ability to set independent activity thresholds per event or per group to understand relationships between dramatically different activities. With its proactive approach, it helps you identify and respond to threats in real time.

Key areas where SolarWinds LEM helps you:

• Monitoring Security Events: Event correlation allows you to effectively troubleshoot issues by understanding the relationship between various activities using multiple event correlations and alerts you as and when it encounters a security threat.
• Threat Remediation: Active responses help you in responding timely to policy violations and troubleshooting issues. Some key active responses include:

1. • Delete User Account and User Group
   • Block IP address
   • Log Off User
   • Restart/Shutdown Machine
   • Disable USB devices

• Event forensics help you identify suspicious behavior patterns on your network.

The Password serves to protect your financial transactions, your social networking sites, and a host of other nominally secure websites online. People often say, "don't use dictionary words as passwords. They are horribly unsecure", but what if hackers also managed to crack any 16 character password ?

Criminals or trespassers who want to crack into your digital figurative backyard will always find a way. A team of hackers has managed to crack more than 14,800 supposedly random passwords from a list of 16,449 converted into hashes using the MD5 cryptographic hash function.

The problem is the relatively weak method of encrypting passwords called hashing. Hashing takes each user's plain text password and runs it through a one-way mathematical function. This creates a unique string of numbers and letters called the hash.

The article reports that, using a commodity computer with a single AMD Radeon 7970 graphics card, it took him 20 hours to crack 14,734 of the hashes, a 90-percent success rate using Brute force method. Brute-force attacks is when a computer tries every possible combination of characters.

In December it was unveiled by Jeremi Gosney, the founder and CEO of Stricture Consulting Group, that   a 25-computer cluster can cracks passwords by making 350 billion guesses per second. It can try every possible word in less than six hours to get plain text passwords from lists of hashed passwords.

Using passwords that contained only numbers, 12 digits long, hackers managed to bruteforce such 312 passwords in 3 minutes.  Anyway password doesn't have to be a word at all. A whole phrase or sentence, a passphrase, offers more security. A correctly chosen passphrase is easy for you to remember but difficult for anyone else to guess.

Also the strongest password in the world isn't secure if you use it for every one of your secure sites. If one site is compromised and hackers are able to crack your password and you've reused it they could then gain access to your details on other websites.

The general public has no control over which hashing process websites use and therefore are at the mercy of an algorithm which they may know nothing about. If you are concerned about security, long passwords are the best defense.