Event management

THE PARTNERSHIP THAT BUILDS-UP YOUR TEAM, OPERATIONALIZES YOUR SIEM, AND BETTERS YOUR SECURITY POSTURE IN THE LONG RUN.

The security landscape is always changing, and high-level security architects are hard to come by. Products are helpful, but it is the mapping of the products, technology and organizing business politics, policies, compliance requirements, current teams, and objectives that matter.

Your information security needs to be done correctly, quickly, and professionally to ensure you have the highest visibility into your environment.

And while partnerships for pen testing and tabletop services are crucial to the development of your security operations, your partnership with a SIEM service provider will provide the hub for all your security activity.

What Is a SIEM?

Security Information and Event Management (SIEM) is a software and solution for logging, monitoring, alerting, anticipating, correlating and visualizing security-related events and information garnered from networked devices. Plainly, SIEM is a combination of both processes and tools, or products.

SIEM converges various cybersecurity practices with rich contextual information via an aggregated security data repository for network logs, correlation engines, event modelers with alarm customization, ticketing, predictive analyzers and a decision support system that can be augmented with big data analytics for on-demand reporting and compliance.

SIEM-Function-Revised

What is Cloud-based SIEM?

Cloud-based SIEM is provided as a service for organizations. The SIEM platform with its various tools are in the cloud. This means no hardware and lower operational costs across the board. Monitor, analyze, and update your SIEM from one cloud access point.

SIEM Tools

A few known platforms and software. (Not a complete list):

WHO USES A SIEM?

Although predominantly utilized by sectors like the government, finance, healthcare, manufacturing and law, any organization that is vulnerable to cybersecurity threats like malware, ransomware, zero-day exploits, cyber warfare and insider threats, should implement SIEM (preferably at the beginning or early stages of business expansion). Compliance requirements like GDPR, NIST, audits and log management are another reason.

Do startups need a SIEM?

Cyber attacks do target small businesses. However, many startups can do without a SIEM if data backup policies and general security best practices are followed well. As the business scales up, SIEM should definitely be considered.

SIEM Definitions

Although others in the industry may use these terms in different ways, here is a brief list of a common words you may come across:

Alarm – Anything that comes from the SIEM, IPS, or Endpoint solution that is notifying you of a potential threat, security risk, or operational problem.

Alert – A notification from which an analyst will determine if the Alert needs to be converted to a case, merged with an existing case, or closed as a false positive or “noise.”

Analyzer – When an Observable is detected, analysts may run tools called Analyzers to automatically gather intelligence about that particular piece of data.

Case – When an Alert requires investigation or work, the Alert is converted into a Case. Within a Case, tasks can automatically be generated within the Analyzer.

Breach – A verified incident that results in information being accessed, disclosed, or exposed.

Event – An occurrence that may go against your company’s security policy or result in unauthorized activity.

Log – A recorded activity taking place in your company’s cyber environment. Logs may originate from your security controls and network infrastructure. Essentially a record of every contact or touch made in your systems.

Observable – Key data points that are identified in an Alarm that allow an analyst to more quickly identify the nature of the activity in question. An Observable could be an IP Address, Domain, URL, or File Hash. IP Addresses are the most common Observable.

Incident – An event that does result in unauthorized activity or access.

Parsing – A rule created to extract data from a log to common fields by the SIEM.

Risk – The likelihood of a threat to enact a certain amount of damage or harm.

Rules – A sequence of correlated logic from logs derived from one of more log sources that when those data points are observed the activity triggers an alarm or alert.

Threat – Event or activity with the potential to cause damage or do harm.

Use Case – A specific situation or scenario in which the product is used.

Tuning – Adjusting your alarms and rules to lessen the “static” or “noise” created by logs that do not need further review.

WHAT IS MANAGED SIEM?

Cybercrime, increasing complex attack vectors, growing hordes of threat actors, shortage of security professionals, and 24x7 readiness are many of the reasons organizations are moving towards managed security providers.

MANAGED SIEM OPTIONS

In-House SIEM
Co-Managed SIEM
Multi-Tenant SIEM

WHO BENEFITS

Many businesses may have a SIEM but no way to manage it or provide the workforce needed to review the SIEM’s collected logs. According to the 2019 SIEM Survey Report from AlienVault, 76% of enterprises say SIEM reduces the likelihood of a security breach and 30% of those enterprises also report a reduction in breaches overall. While SIEM can be effective in reducing the likelihood of a breach, in helping to monitor the environment, and in detecting threats, 40% of enterprises say they lack expert or trained staff to manage their SIEM.

SMALL IN-HOUSE TEAMS

Businesses with a large environment but smaller staff. Those who spend more time putting out fires than completing projects and whose engineers tend to operate in a reactive mode, not proactive.

WHY CO-MANAGED SIEM?

If you’re hiring a company to help with your company’s SIEM, you can normally choose from two options: co-managed and managed SIEM. While both solutions have their pros and cons, there’s a strong internal debate in the security community on which option is the best choice.

Companies like to choose co-managed SIEM when they have a decent in-house IT staff but lack the bandwidth to monitor alerts constantly. Such organizations often use the co-managed solution to cut operational costs while they are smaller but look to move many of the functions in-house as they mature. Co-managed SIEM is also known to be a positive step toward building a SOC within your own IT team.

crossorigin="anonymous"></script>

Rechercher dans ce blog

network