Industry View

Ensure ROI on Security Investments Using Soccer Management as a Model

Jason Holloway of ExaProtect explains how CSOs can use soccer management as a model and CSEM as a tool in guarding their companys assets and ensuring ROI on security investments.

By Jason Holloway

June 30, 2006 — CSO —

Being a CSO is rather like being a soccer manager. Both have to make the best use of limited resources to deliver the results demanded of them. But at first glance, a soccer manager seems to have many more resources at his disposal, from the players to coaching staff, assistants, and luxuries such as in-depth TV and video analysis of games. A CSO has only a certain head count, budget and IT resources available, yet has to manage all of these strategically and squeeze out the best valueirrespective of conditions or external factors.

So what does a CSO have to help manage his companys security? Staff, certainly. The IT team will also have a range of management consoles from the companys various security products to give a snapshot of current security events. But there are still some elements missing.

In a soccer game, a player whos nursing an injury or is tired is easy to spotbut similar vulnerabilities are not as easy to see in complex corporate networks. This means CSOs and their teams may not easily see threats to security emerging, nor be able to react to them accurately in real time.

In the Stands or Pitchside?

This lack of vision is often because CSOs and their teams dont have the ability to get an overall view of security events as they happen, or of their networks security status. A soccer manager can go up into the stands for a birds-eye view of the action, or be on the touchline to be closer to the game. But in IT security, you dont always have the luxury of an overarching view of events as they unfold.

Whats more, unlike a soccer game, you may not have the benefit of in-depth match analyses and post-mortems, to see what happened and what could be improved during a security "game."

But there is a way for CSOs to gain the resources available to the Scolaris, Erikssons and Klinsmanns of the world and to achieve their fantasy security team. Its core security event management (CSEM), a practice that has developed from the drive to unify network management, but focused specifically on information security.

The Core of the Game

So how does CSEM help? First, the CSEM solution links to core business systems to give an overall view of network activity, reporting on any changes to core assets, whether applications, servers, desktops, notebooks or PDAs.

By doing this, it adds value to an enterprises multiple existing security products, integrating all security management consoles and reporting formats to simplify control, provide greater visibility and improve response times. By filtering, prioritizing and correlating the data and log traffic generated by multiple systems, CSOs and their team get a less cluttered view of whats happening on and around their networks. Such a system can overlay multiple reporting logs and data streams to give IT staff a single-console view of critical security events, also integrating with asset management systems and similar solutions.