Comments on: Ten Reasons Log Data is Not Enough: #1. Logging can be turned off http://blog.eiqnetworks.com/2009/09/03/ten-reasons-log-data-is-not-enough-1-logging-can-be-turned-off/ Perspectives on Security and Compliance Management from eIQnetworks Thu, 29 Oct 2009 15:57:47 +0000 http://wordpress.com/ hourly 1 By: Ten Reasons Log Data is Not Enough #7: Your SIEM forgets « eIQviews http://blog.eiqnetworks.com/2009/09/03/ten-reasons-log-data-is-not-enough-1-logging-can-be-turned-off/#comment-218 Ten Reasons Log Data is Not Enough #7: Your SIEM forgets « eIQviews Tue, 13 Oct 2009 12:50:39 +0000 http://blog.eiqnetworks.com/?p=255#comment-218 [...] kind of low and slow attack. Well, we’ve already discussed how to deal with the reality that logging will be turned off by the attackers. Another method we use at eIQ is to extend the correlation window. That’s right, SecureVue [...] [...] kind of low and slow attack. Well, we’ve already discussed how to deal with the reality that logging will be turned off by the attackers. Another method we use at eIQ is to extend the correlation window. That’s right, SecureVue [...]

]]> By: Ten Reasons Log Data is Not Enough: #3. What’s the Configuration, Kenneth? « eIQviews http://blog.eiqnetworks.com/2009/09/03/ten-reasons-log-data-is-not-enough-1-logging-can-be-turned-off/#comment-170 Ten Reasons Log Data is Not Enough: #3. What’s the Configuration, Kenneth? « eIQviews Thu, 10 Sep 2009 18:55:00 +0000 http://blog.eiqnetworks.com/?p=255#comment-170 [...] repeatedly mentioned, log management systems are driven by log data. And as we showed in Reason #1, logging can (and usually is) turned off – by savvy attackers [...] [...] repeatedly mentioned, log management systems are driven by log data. And as we showed in Reason #1, logging can (and usually is) turned off – by savvy attackers [...]

]]>