Notifying the Enterprise about Outages James Voorhees April 2009 SANS Technology Institute Presentation

SANS Technology Institute Presentation Tasks When users at <COMPANY NAME> cannot use a service, someone must Tell the people who can fix it Tell the people who need to know The number of events that you see in ArcSight will far exceed the number that you or your team can analyze. They need to be pared down and then displayed in the tools that ArcSight provides you in a way that makes it easy to determine quickly what is going on in the network and to find the events of interest that are worthy of further investigation and may require action. There is no quick way of doing this. It takes time and effort that may be hard to spare from other tasks. But a failure to put in that time and effort will mean that ArcSight will not reach its potential. This task needs to be approached methodically, with a clear plan in mind. This presentation will give you a clear path to follow.s -------- Script: To star; Ask: how many use a SIM? How many get enough out of it to justify the cost? Mention GIAC-Alumni query SANS Technology Institute Presentation

SANS Technology Institute Presentation The NOSC Network Operations and Security Center Monitors the network 24/7/365 If something goes down, they know Maintains notification lists Documents each outage SANS Technology Institute Presentation

SANS Technology Institute Presentation Outage! NOSC sees it in its monitoring tools Or the NOSC is told by system owners They must tell the NOSC before a planned outage happens Or as soon as they learn of an unplanned outage SANS Technology Institute Presentation

SANS Technology Institute Presentation Action: Find the Fixer The NOSC maintains a list of contacts for each system If a system or service goes down, the NOSC informs the contact The contact can then fix the system Or find the person who can SANS Technology Institute Presentation

SANS Technology Institute Presentation Then, Inform The Outage List is informed This is a list of people and groups who are affected by most outages or can end them. It includes systems and network people and the Help Desk The NOSC tells them What the outage is When it happened Why it happened Also, what is being done and how long it will take SANS Technology Institute Presentation

SANS Technology Institute Presentation Senior Management If a major outage lasts 12 hours, Senior Management wants to know. Like the Outage List, the NOSC tells them what happened, when, and why And who is doing what SANS Technology Institute Presentation

SANS Technology Institute Presentation Updates When the situation changes, the Outage List is informed Senior Management is updated every 12 hours. This is done until the outage ends SANS Technology Institute Presentation

SANS Technology Institute Presentation Questions? Contact the NOSC: nosc@<CompanyName>.com 703-555-1212 SANS Technology Institute Presentation