Reducing the stream of false positives

摘要

One of the biggest problems in managing security for your organization is the ability to properly identify false positives. Often, the excitement of a new security or intrusion detection device gives way to the realization that the logs are too informative. All too quickly, what is supposed to be valuable data becomes irrelevant and diminishes the value of logging. As more and more online applications find their way into mainstream corporate culture, it is very important that security engineers understand how they work, so they can properly identify the characteristics while combing through their intrusion detection log files in search of attack signatures.