Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 30 / 588

1-2
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 1 STM Task Flow Overview
Checklist for Provisioning Phase
•
Identify the responses to detected but unmitigated attacks for each type of node in your network.
• Identify tool vendor update policies to ensure proper remediation of hosts and applications.
•
Identify the policies and procedures for isolating infected legacy hosts where remediation options
are unavailable. These procedures may include restoring from backups or network isolation.
After you develop your policies, they become the hub of the Cisco Security Wheel, ( Figure 1-1 ).
Figure 1-1 Cisco Security Wheel
The spokes of the Cisco Security Wheel represent network security as a continual process consisting of
four steps:
1.
Secure your system.
2.
Monitor the network for violations and attacks against your security policy and respond to them.
3.
Test the effectiveness of the security safeguards in place.
4. Manage and improve corporate security.
You should perform all four steps continually, and you should consider each of them when you create
and update your corporate security policy.
The remainder of this section details recommended task flows according to the following project phases:
•
Provisioning (see Checklist for Provisioning Phase, page 1-2 ).
•
Monitoring (see Checklist for Monitoring Phase, page 1-9 ).
Check out http://www.cisco.com/web/about/security/intelligence/articles.html for more planning ideas.
Look closely at the SAFE information.
Checklist for Provisioning Phase
Provisioning deals with planning, setting up and configuring the hardware, software, and networks that
actually provide access to the data and network resources for the MARS Appliance. This phase takes
place after you successfully complete the installation, which was detailed in the
Install and Setup Guide
for Cisco Security Monitoring, Analysis, and Response System.
The following checklist describes the tasks required to understand the decision-making process and the
basic flow required to provision MARS in the most productive manner. Each step might contain several
substeps; the steps and substeps should be performed in order. The checklist contains references to the
specific procedures used to perform each task.