This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

LEM Thoughts of the Week: What IT Security Buzzword Drives You Nuts?

FormerMember over 10 years ago

In honor of the RSA Conference (et al) this week, where buzzwords and BS are sure to be running high...

What IT Security buzzword or nonsense trend drives you nuts? What's your pet peeve topic, question, product, or buzzword? Read an article recently that made you say "that's nonsense" or cringe? Maybe one of those irritating "security predictions for 2014" articles that says the same thing every year, or states the obvious?

Mobile security is one of my favorites over the last 5 years. This year will be the year of AV on phones, I'm sure of it! If we're wrong, now let's call it something else - mobile device management, BYOD...

What about you?

PS: We'll have an early topic of the week on Thursday for next week thanks to this month's customer newsletter.

Parents

0 cscoengineer over 10 years ago

Non-Linear Correlation
I have had people ask me to show them a concrete example of non-linear correlation in LEM. This idea is more of a statistical relationship within the dataset rather then creating a 'non-linear' filter rule.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 cscoengineer over 10 years ago

Non-Linear Correlation
I have had people ask me to show them a concrete example of non-linear correlation in LEM. This idea is more of a statistical relationship within the dataset rather then creating a 'non-linear' filter rule.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 FormerMember over 10 years ago in reply to cscoengineer

Well, what WE mean when we say non-linear is that events can fire a correlation regardless of the order they occur.A lot of correlation engines have an "A, followed by B, followed by C" building blocks approach not an "A and B and C need to happen within a reasonable timeframe of one another" approach. Sometimes events don't come in in order due to different sources (if you're correlating firewall data with OS data, one might be faster than the other). Since rules that correlate multiple events are fairly uncommon in the scope of things (most people still have "small data" problems ) it's not really an every day exercise. It would take many rules to do what 1 rule would do if you really meant the second one and had to build a rule for all the permutations. (OTOH if you really mean the first one, we can do that, too, because the timestamps are a part of the event.)
Cancel
Vote Up 0 Vote Down

Cancel