Explore enterprise-level Network Security Monitoring (NSM) implementation using Security Onion in this conference talk from BSides Augusta 2014. Learn about NSM fundamentals, its advantages over traditional IDS, and strategies for overcoming challenges in large-scale deployments. Discover how to address compliance issues, gain management buy-in, and collaborate with network teams for optimal sensor placement. Delve into performance optimization techniques, including flow-based load balancing and hardware sizing recommendations for various network speeds. Gain insights on data management, Security Onion customization, and advanced features like user management, rule configuration, and the Bro Intel Framework. Conclude with valuable tips, tricks, and future developments for Security Onion, empowering you to scale your NSM capabilities effectively across enterprise environments.
Scaling Security Onion to the Enterprise - Lecture 102