Incident Management Tools and Technologies
An information security manager needs to have a basic understanding of the following tools and technologies for managing incidents:
- Incident management systems
- Personnel
- Audits
- Outsourced security providers
Incident Management Systems
In recent years, a high volume of data and activities has prompted organizations to invest in and adopt automated incident management systems (IMSs). Many previously manual processes are automated by these systems, which filter data to help identify potential incidents and alert the incident management team (IMT).
An IMS can be in the form of a distributed or a centralized system. In a distributed system, multiple devices are placed to monitor incidents. For example, network intrusion detection systems (NIDSs), host-based intrusion detection systems (HIDSs), logs, and so on.
Security information and event management (SIEM) is a centralized system. SIEM is an automatic log reader...
