The Technology and Practice of Comprehensive Information Security Management for Wireless Mobile Environment

The high volume of events created by a large number of security devices, increased threat levels, and the struggle to keep pace with the expansive list of vulnerabilities that grows daily epitomize the problem of managing information security in today´s wireless mobile network. The paper present Comprehensive Information Security Management (CISM) solution, which is based on the technology with a fully integrated incident resolution workflow based on the best practices for incident resolution management. CISM combines three main correlation technologies in concert to help security team work smarter. That is, CISM implement a solution that allows them to correlate events against known vulnerabilities, implement correlation rules that identify successive related suspect events, and use statistical models to score threats based on vulnerability and asset importance. The paper describes the system framework and general design scheme of CISM, which puts emphases on security event normalization and the structure design of security event correlation engine.