Rachel manages security for a small bank and has a firewall at the gateway as well as one at each network segment. Each firewall logs all accepted and rejected traffic. Rachel checks each of these logs regularly. What's the first step that should be taken to improve this firewall configuration?

Question

Business

Haney

4 December, 12:48

Rachel manages security for a small bank and has a firewall at the gateway as well as one at each network segment. Each firewall logs all accepted and rejected traffic. Rachel checks each of these logs regularly. What's the first step that should be taken to improve this firewall configuration?

+3

Answers (1)

Know the Answer?

Rudy Jacobs · Answer 1

Integrate with SIEM

Explanation:

Security information and event management (SIEM) is a security management approach that integrates the roles of SIM (Security Information Management) and SEM (Security Event Management) into one security management system.

The first step to be taken is to integrate it with a SIEM so that all logs are consolidated and protected. Honeypot and honeynet are completely unrelated to the scenario and it is a great idea to integrate with AD, but it does not boost the setup of the firewall.