Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 30

Checklist for Provisioning Phase
•
•
•
After you develop your policies, they become the hub of the Cisco Security Wheel,
Figure 1-1
The spokes of the Cisco Security Wheel represent network security as a continual process consisting of
four steps:
1.
2.
3.
4.
You should perform all four steps continually, and you should consider each of them when you create
and update your corporate security policy.
The remainder of this section details recommended task flows according to the following project phases:
•
•
Check out http://www.cisco.com/web/about/security/intelligence/articles.html for more planning ideas.
Look closely at the SAFE information.
Checklist for Provisioning Phase
Provisioning deals with planning, setting up and configuring the hardware, software, and networks that
actually provide access to the data and network resources for the MARS Appliance. This phase takes
place after you successfully complete the installation, which was detailed in the Install and Setup Guide
for Cisco Security Monitoring, Analysis, and Response System.
The following checklist describes the tasks required to understand the decision-making process and the
basic flow required to provision MARS in the most productive manner. Each step might contain several
substeps; the steps and substeps should be performed in order. The checklist contains references to the
specific procedures used to perform each task.
User Guide for Cisco Security MARS Local Controller
1-2
Identify the responses to detected but unmitigated attacks for each type of node in your network.
Identify tool vendor update policies to ensure proper remediation of hosts and applications.
Identify the policies and procedures for isolating infected legacy hosts where remediation options
are unavailable. These procedures may include restoring from backups or network isolation.
Cisco Security Wheel
Secure your system.
Monitor the network for violations and attacks against your security policy and respond to them.
Test the effectiveness of the security safeguards in place.
Manage and improve corporate security.
Provisioning (see Checklist for Provisioning Phase, page
Monitoring (see Checklist for Monitoring Phase, page
Chapter 1 STM Task Flow Overview
(Figure
1-2).
1-9).
1-1).
78-17020-01