C H A P T E R
1-1
User Guide for Cisco Security MARS Local Controller
78-17020-01
1
STM Task Flow Overview
This chapter describes the project phases and task flows that you should follow when you deploy MARS
as a security threat mitigation (STM) system in your network. First, however, you must develop a set of
policies that enables the application of security measures.
Your security policy should:
•
Identify security objectives for your organization.
•
Document the resources to protect.
•
Identify the network infrastructure with current maps and inventories.
•
Identify the critical resources (such as research and development, finance, and human resources)
that require extra protection.
Your monitoring policy should:
•
Identify the expected administrative traffic flows across your network, including user, source,
destination, services, and hours of operation.
•
Identify expected network traffic for security probing and vulnerability testing, including user,
source, destination, services, and hours of operation.
•
Identify the network infrastructure able to provide audit data in “network proximity” to the critical
resources.
•
Identify the various event logging levels available from the devices and hosts in the network
infrastructure.
•
Identify the devices and techniques used to investigate
Your mitigation policy should:
•
Identify the choke points on your network relative to the critical resources.
•
Define your process for documenting mitigated attacks on layer 2 and layer 3 devices.
•
Define your process for documenting mitigated attacks at the host and application layer.
•
Resolve corporate ownership issues among network operations, security operations, host owners
and application owners on shared hosts.
•
Identify your policy for notifying security response teams and remediation teams.
•
Identify vendor detection tool prioritization process, such as IOS IPS Dynamic Attack Mitigation
(DAM).
•
Identify how you want to block detected attacks: block them temporarily or permanently, block
them using MARS-generated rules, using custom rules defined by security operations team, etc.
Your remediation policy should:
