What security monitoring can one IT administrator realistically run?
A few well-chosen tools that run on their own, with alerts short enough to read each morning in a few minutes. Realistic for one person: endpoint protection with a central console, multi-factor authentication with sign-in alerts, firewall and VPN logs kept for investigation, a tested backup with a monthly restore check, and one network sensor on a mirror port. Unrealistic for one person: a SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. that needs searches written and tuned, several overlapping consoles, or anything that requires watching dashboards all day. Decide in writing who covers holidays and who decides in an emergency. NetSenX is designed for this situation: one agent on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port per segment, plain-language alerts by e-mail on every plan, and no tuning required to start.
Read next
Related questions
Terms used here
- SIEM (security information and event management)
- A system that collects logs from many systems and looks for patterns across them.
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.