Many readers may already know that I have a deep background in network management with an emphasis in computer and network security. My experience in this area, after leading countermeasure efforts for the USAF in the Langley Cyberattack, motivated me to write a CACM paper applying multisensor data fusion techniques to intrusion detection.
If you look further into the field of security event management or SEM, you will see that complex event processing and security event managment are a perfect match. I first presented the relationship between CEP and SEM for TIBCO at an IDC event in Lisbon; and then followed up at TUCON with a presentation titled, Combating Fraud and Intrusion Threats with Event Processing.
In the TUCON presentation, I outlined SEM functionality and explained the serious shortcomings of the current approaches to SEM in the marketplace. Then, I applied CEP to SEM and explained how CEP, in the context of my CEP reference architecture, holds great promise for SEM.
In this new blog series, Security Event Managment (SEM) with CEP, I will cover this topic in detail. Next in this series, we discuss trends and vulnerabilities in cyberspace.