Tag Info

Hot answers tagged

7

Here is some experience about establishing projects, especially security projects, that applies to consulting and outsourcing that I wrote up on a security stackexchange answer about incident compromises. As for resources, well it is highly dependent on your environment as to what you would need to build and how many people to hire (and at what levels of ...


2

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...


1

I would advise taking the job. Security is a difficult field to get into without experience, and a few years of security operations experience will make you much better qualified for penetration testing jobs that may become available.


1

As the others mentioned this can only be established when you know more requirements. These might include but not be limited to: Region 24x7? scale/type of work involved. (I.e. how much work/ how often ?) For a rough idea you could sketch out how the current incidents you mentioned would've been ideally dealt with, and how much work this would've taken ...


1

You should log everything and analyze anything. People trying to brute your sites and servers. All of these are relevant incidents as they pose a threat. It's not relevant to say to what is an incident, as every attempt might be a relevant event some time. What is important is to catalog them with different levels. Some threats pose greater danger than ...



Only top voted, non community-wiki answers of a minimum length are eligible