When a football is snapped, quarterbacks have a couple of seconds to capture, process, and assess information on the incoming threats.
In football, we are talking about five or six points of attack as the pass rushers attempt to break through the offensive line.
How does football relate to cyber security and logging aggregation?
What even is logging aggregation?
The best quarterbacks in the NFL have the ability to, simultaneously, assess the threats, take avoiding action and decide on the best target to pass to. This is because there are only five or six attack points, i.e., five or six players trying to get through to make the sack – sometimes even less.
In any business, the potential cyber-attack points and types of attack number in the thousands. If you are a large business or a business with a complex IT infrastructure, this number could be exponentially higher. As for the amount of data that needs to be processed and analyzed, it's not unusual to produce terabytes per month. So, having a good IT-equivalent of a quarterback (or team of IT-equivalent quarterbacks) isn't going to be enough, as there is simply too much information coming in from too many sources to identify and assess all the potential threats and/or take action when there is a breach.
This is where logging aggregation comes in. It automates and supercharges the ability of your business to make sense of the huge amounts of data it produces every day, helping to prevent cyberattacks and mitigate the impact of those that make it through your defenses. This makes logging aggregation more than just an IT issue for your business. It is an IT function, for sure, but its importance also makes it a business continuity issue. In other words, without effective IT logging systems and processes, your business will be at a considerably higher risk than it needs to be.
The devices, apps, and systems that make up the IT infrastructure in your organization all produce logs.
These logs capture the events that take place on devices, apps, and systems. Logs are continuously being produced, but they exist largely in silos, so they are not connected.
Not only that, but each log will have loads of information that makes manual searching and analyzing a laborious and often impossible task. Log aggregation pulls all the logs in your organization into a central location.
Log aggregation solutions are also optimized to ensure the right data points and events are being tracked in the right way. With everything in a single location, searching through the logs becomes much simpler and significantly faster, plus you will have data that is more usable.
Let's use a ransomware attack in an organization with 50 computers as a straightforward example.
During a ransomware attack, identifying the source of the breach is crucial to resolving the situation quickly and with minimal impact. Each of the 50 computers in the organization will have tens of thousands of log files.
As there is no logging aggregation in place in this example, each one of the computers (and their tens of thousands of log files) will have to be searched to identify the ransomware breach location. Even if you throw every IT resource you have at this issue, it will still take days or even longer. By then, the damage will be deep, long-lasting, and potentially permanent.
A logging aggregation system will collect the log files in all 50 computers, aggregating them together while filtering out the noise and making sure the most important information is collected. Crucially, the aggregated log files will also be searchable.
So, in our ransomware attack example, the logging aggregation solution will quickly and accurately identify the ransomware breach so mitigation actions can be taken.
Log aggregation is a component of what is known in IT as SIEM – Security Information and Event Management.
SIEM tools should be part of your organization's cybersecurity defenses.
A SIEM tool is responsible for three essential elements of cybersecurity:
- Collecting data from various sources, from devices to servers to SaaS platforms. These log files are then normalized and aggregated to produce a usable, searchable data source. This part of the SIEM process is the log aggregation element.
- A SIEM tool will analyze the data that is collected and aggregated to identify threats, attacks, and anomalies that could evolve into a cybersecurity breach.
- A SIEM tool will then notify your IT team so corrective or mitigating action can be taken. Manual investigation and searches of the aggregated data are often crucial parts of this stage of the process.
Log aggregation solutions don't just identify threats that have occurred or are occurring, as they can also identify potential threats that warrant further investigation.
One of the ways log aggregation solutions do this, for example, is to identify strange activity that could be an indicator of an impending attack.
Let's look at potential real-world examples of cyber threats that log aggregation and subsequent log analysis can help to protect against.
Serious Alert – Compromised Business Email
In this example, cyber attackers manage to successfully infiltrate the email account of a member of staff through a phishing exercise.
The compromised email account starts sending out emails to its contacts. The owner has no idea, however, as the code the attackers are using automatically deletes the emails once they are sent, so they don't appear in the sent folder.
People receiving an email will think it was sent by the account owner, so they will respond. By responding, their email accounts are now compromised. Plus, even though the recipients are responding, the owner of the first compromised account still has no idea anything is wrong because the attackers are diverting or deleting the replies too.
In the above situation, there will be a massive amount of information in log files related to the cyberattack – log files on computers, mobile devices, email clients, etc. Trawling through that information to find the source of the breach is next to impossible without log aggregation.
False Alerts Quickly Resolved
It is also important to ensure time is not wasted on false flag events that look like cyber threats but are not. For example, a system might flag an anomaly somewhere in your network that has the potential of being a cyberattack.
It is then possible to quickly dismiss the event as a false alarm by searching the aggregated log file, as the log file will tell you exactly what happened.
Log aggregation is all about data.
You will have tools, systems, and processes that aim to prevent cyberattacks from getting through to your systems and data in the first place. No cybersecurity solution is 100 percent secure, however, so attacks can and still do happen.
It is in these situations where log aggregation and SIEM tools become so important, as they will help you quickly and effectively find and implement a solution.
To speak to one of our experts about implementing log aggregation to beef up the security of your IT infrastructure, get in touch today.
"Thank you for reading!"
