SANS report shows security logs no longer "geek toys"

In fact, use of log data has mushroomed in recent years. In 2007, 56 per cent of survey respondents collected logs, but in 2009 the figure jumped to 87 percent.

The top reason organisations collect log data is for security event detection, the survey showed. That means tracking suspicious behavior and monitoring user activity online. Other reasons, according to the survey, are for forensic analysis, operations/process control and regulatory compliance. As to compliance, organisations indicated that they wanted to make use of the terabytes of logs they've already gathered in complying with regulations.

In addition, organisations increasingly integrated log data with their security information event management (SIEM) systems, according to the survey. More than 30 percent of respondents said they are integrating log management with SIEM, and 26 percent plan to do so.

“The tide has turned," report author Jerry Shenk, senior analyst for the SANS Institute, wrote in his summary. "Log management is no longer a toy just for the geeks."

“As this year's survey indicates, some keys to success in a log management initiative include getting started, integrating log management into the normal workflow or process, measuring effectiveness, and automating functions like normalisation and reporting,” he added.

SANS has surveyed the log management industry every spring since 2005. The surveys afford insights into why people use logs, what problems they encounter and what users would like to see from vendors.

See original article on scmagazineus.com