• Save
Extending Log Management to Desktop for LEM Users
 

Extending Log Management to Desktop for LEM Users

on

  • 742 views

Join SolarWinds Sales Engineer Rob Johnson for an exclusive presentation for LEM Customers on LEM’s new Workstation Edition Features. There will be explanations on how to expand your compliance and ...

Join SolarWinds Sales Engineer Rob Johnson for an exclusive presentation for LEM Customers on LEM’s new Workstation Edition Features. There will be explanations on how to expand your compliance and log management to desktops for current LEM Customers

Statistics

Views

Total Views
742
Views on SlideShare
737
Embed Views
5

Actions

Likes
0
Downloads
0
Comments
0

1 Embed 5

https://thwack.solarwinds.com 5

Accessibility

Categories

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment
  • Threats to the network aren’t just external, internal threats and security risks introduced by employees pose a very real problem that must be addressed to ensure the integrity and safety of critical network data.Log analysis and security event monitoring shouldn’t be limited to security devices, network infrastructure, and server systems. Monitoring workstation activity is a key part of securing your network’s critical data.Workstations process content from the Internet and email; they come in contact with infected files, external mass storage devices, and can connect to insecure networks over Wi-Fi.

Extending Log Management to Desktop for LEM Users Extending Log Management to Desktop for LEM Users Presentation Transcript

  • 1 SolarWinds® Log & Event Manager Workstation Edition © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
  • 2 © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. Short of eliminating users, how can you effectively protect your network against them? (remember, you need end-users, they’re great job security)
  • 3 Agenda » Workstation Log Monitoring – Why it Matters » Extending Your LEM Installation to Monitor Workstations » LEM Workstation Edition Licensing & Pricing » Helpful Resources for Additional Reading © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
  • 4 The Importance of Monitoring Workstation Logs © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. A. To Protect Data and Prevent Data Loss! Q. Why do I need workstation log & event monitoring? • Internal threats and security risks introduced by employees pose a very real problem • Workstations are one of the more vulnerable entities on your network • Compliance requirements may mandate monitoring of workstations
  • 5 Key Use Cases for Workstation Log Monitoring » Unauthorized users logging on to workstations » Multiple failed logon attempts » Use of unauthorized USB drives and other attached devices » Launch of prohibited applications (IM, games, etc.) » Changes to local accounts and groups » System changes, such as installation of unexpected software and changes to local policies © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. What are key workstation activities I should look for?
  • 6 What is LEM Workstation Edition? » It’s a new pricing model designed for SolarWinds LEM customers to make workstation log management more affordable than ever! » Workstation Edition provides ALL the functionality of LEM to help you cost-effectively collect, correlate, analyze and store logs from a greater number of workstation nodes. © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. LEM Workstation Edition is a way to extend your existing LEM install
  • 7 Benefits of Using LEM Workstation Edition » Extend LEM’s powerful log collection, correlation, analysis and management functionality to cost-effectively cover more workstations and protect against endpoint vulnerabilities. » Monitor all workstation events in real-time:  Security events – assists with monitoring and preventing  Operational events – identify and troubleshoot performance issues  Policy-driven events – analyze and report compliance and policy violations » Take Action!!!  Leverage Active Responses to automatically combat workstation security threats in real-time—no human intervention required!  Ensure your network stays protected against endpoint threats even when you’re sleeping! © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
  • 8 Windows® Log Management with LEM © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. » Use LEM Workstation Edition right alongside your existing LEM license to monitor both your Windows servers and workstations COST-EFFECTIVELY.
  • 9 Useful Workstation-based LEM Active Responses » Kill Suspicious and Unapproved Processes  The Kill Process Active Response enables LEM to automatically kill a suspicious or unapproved process by name or ID.  This action helps protect against unauthorized, malicious, or otherwise unknown processes from consuming system resources at the least or propagating a virus that takes down the network at worst » Disable Networking on Infected Workstation  Use the Disable Networking Active Response to disable networking on a workstation at the Windows® Device Manager level.  This action is useful for isolating network infections and attacks, and can be automated in a LEM rule, or executed manually from the Respond menu in the LEM Console. © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. LEM
  • 10 Useful Workstation-based LEM Active Responses » Remove Unapproved Users from Administrative Group  LEM uses a Windows Active Response tool based on where you want to remove the user(s) from—the domain level or local level.  This action protects against elevated privileges that could allow a user to access restricted resources or make harmful system changes » Detach Unauthorized USB Device  The Detach USB Device Active Response allows you to automatically detach a USB or mass storage device from a workstation.  This action is useful for allowing only specific, approved devices to be attached to your Windows computers or detaching any device exhibiting suspicious behavior. © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. LEM
  • 11 Supported Workstation Operating Systems » LEM Workstation Edition supports the following client operating systems and are known as Workstation Nodes:  Windows XP  Windows Vista®  Windows 7 » All other data sources including Windows Server 2003, 2008, 2012 are part of LEM server license, known as Universal Nodes. © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
  • 12 LEM Workstation Edition Licensing & Pricing » LEM differentiates workstation nodes from non-workstation nodes only in terms of pricing and NOT functionality. » Workstation node-based licensing model gives you the cost benefit of monitoring thousands of workstation logs at affordable and competitive pricing. » You can upgrade your existing deployment to cover workstations. © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. Refer to pricing and licensing details of LEM Workstation Edition here: http://www.solarwinds.com/OnlineQuote/LicenseCalculator.as px?productid=27&region=NA
  • 13 Helpful Resources » For Additional Reading:  Why & How of Monitoring Workstations with Log & Event Manager  Why Workstation Log Management is Crucial For Network Security  Useful Active Responses to Combat Workstation Security Threats  Workstation Log Management Made Easy with the New LEM 5.6 © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
  • 14 Trademark The SOLARWINDS and SOLARWINDS & Design marks are the exclusive property of SolarWinds Worldwide, LLC, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks, registered or pending registration in the United States or in other countries. All other trademarks mentioned herein are used for identification purposes only and may be or are trademarks or registered trademarks of their respective companies. © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
  • 15 Thank You! © 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.