SIEM

What is the Definition of SIEM?

Security information and event management (SIEM) is a set of tools and services that combine security events management and security information management capabilities to enable analysts to review log and event data, understand and prepare for threats, and retrieve and report on log data.

What is the Purpose of a SIEM?

Today’s businesses are composed of many types of applications, databases, devices and users. These complex environments can provide many places where advanced or novice adversaries can operate undetected for months or even years. This problem is caused by a lack of visibility into the environment.

SIEMs provide visibility into malicious activity by pulling data from every corner of an environment and aggregating it in a single centralized interface, where it can be used to qualify alerts, create reports and support incident response.

Who Needs a SIEM?

Any company that is concerned about data security is a suitable candidate for a SIEM. Organizations subject to regulatory compliance, such as retailers and healthcare providers, particularly benefit from a SIEM because SIEMs ease compliance audits.

However, only slightly more than half of organizations that say they need a SIEM actually use one. Despite the fact that cybersecurity budgets continue to increase, filling the positions necessary to make a SIEM worthwhile remains challenging. Forty-four percent of organizations report difficulties in achieving the benefits their SIEMs could provide because of a lack of on-staff expertise. An option for companies like these is to engage a third-party provider, such as a managed security services provider (MSSP) or SIEM-as-a-service, to operate their SIEM on their behalf.

Enterprises are most likely to use a SIEM because they already have the well-staffed security operations centers (SOCs) necessary to gain full value from a SIEM and because they have a need for the greater security measures and better compliance management that SIEMs provide.

What Benefits Does a SIEM Provide?

A SIEM provides organizations with four types of security benefits:

1. Efficiency
A SIEM uses automation and machine learning to improve visibility, ease the workload in the SOC, and provide more reliable and powerful reporting for IT and compliance purposes.

2.Threat prevention and mitigation
SIEMs make vast amounts of data human-accessible, so threats can be prioritized and responded to more easily and quickly, no matter where in the environment they occur.

3.Cost savings
Because a SIEM increases the efficiency of the security team by automating low-level tasks and increasing the speed with which they can address events, it lowers the cost of operating a SOC.

4. Compliance
SIEMs can include built-in compliance reporting that prevents violations and makes audits much easier and faster. This also reduces compliance costs.

What Tasks Can a SIEM Perform?

We’ve covered the various benefits a SIEM can provide organizations. In addition to these benefits, it’s important to understand what specific tasks a SIEM can help organization security teams perform.

In the Critical Capabilities for Security Information and Event Management,1 Gartner identifies the use cases of SIEM as follows:

• Monitor, correlate and analyze activity across multiple systems and applications
• Discover external and internal threats
• Monitor the activities of users and specific types of users, such as those with privileged access (both internal and third parties), and users with access to critical data assets such as intellectual property, and executives
• Monitor server and database resource access, and offer some data exfiltration monitoring capabilities
• Provide compliance reporting
• Provide analytics and workflow to support incident response, and increasingly the ability to orchestrate and automate actions and workflows, powering SOC types of use cases

In a typical implementation, tasks that a SIEM will perform can include:

Data aggregation: Consolidates data from many systems, making searches easier and faster.

Threat detection: Analyzes behavioral data collected from the environment and exposes suspicious patterns.

Forensic investigations: Performs in-depth analysis of major security events using advanced tools to provide unalterable evidence that can be useful in court.

Compliance and auditing:
Supports PCI DSS, HIPAA, GDPR, SOX and other regulations by enabling strong perimeter security, real-time threat detection, visibility into logs, access control, and automated reports and documentation.

How does a SIEM work?

What makes up a SIEM?

A SIEM is a set of tools and services that includes:

1. Dashboard
A single pane provides a user-friendly way for SOC staff to interact with data, manage alerts, track the status and activity of vulnerability protection products, and identify systems that are no longer being scanned for vulnerabilities.

2. Analytic capabilities
Gains insights from vast amounts of data and applies machine learning to automatically identify hidden threats. Analytics-driven SIEMs can combine IT operational data and security intelligence to enable the identification of a specific vulnerability.

3. Advanced threat detection
Uses network security monitoring and endpoint detection and response sandboxing and behavior analytics to identify and quarantine new potential threats, and correlates defenses across different styles of advanced persistent threats.

4. Threat intelligence
Correlates current data on indicators of compromise and adversary tactics, techniques and procedures in context with other information on incidents and activities to make it easier to expose abnormal events.

5. Compliance reporting
The logs of every host that needs to be included in reporting are regularly and automatically transferred to the SIEM, where they are aggregated into a single report that can be customized for rich compliance reporting on one host or many. Reporting capabilities are compliant with mandated requirements for PCI DSS, HIPAA, GDPR and SOX.

Who operates the SIEM?

SIEMs are used by analysts, incident response teams and forensic investigators to conduct threat detection, investigation and responses.

Are there any limitations to using a SIEM?

SIEMs are only as good as the data they collect. It must be comprehensive and in context.

SIEMs cannot always provide complete context on unstructured data. That can lead to false alerts, which can lead, in turn, to alert fatigue on the part of the SOC team.

Also, SIEMs cannot discriminate between sensitive and non-sensitive data, and therefore cannot differentiate between sanctioned activity and suspicious activity.

Security teams can find it difficult to diagnose and research security events because of the high volume of alerts and data provided by the SIEM. Responses to alerts can be delayed or overlooked because analysts lack an understanding of which alerts need attention.

SIEMs do not replace enterprise security controls such as intrusion prevention systems, firewalls or antivirus technologies. The SIEM itself does not monitor events as they happen throughout the enterprise in real time, but rather uses log data recorded by other software to determine that an event occurred.

SIEM tools

Gartner recommends that “security and risk management leaders increasingly seek security information and event management solutions with capabilities that support early attack detection, investigation and response. Users should balance advanced SIEM capabilities with the resources needed to run and tune the solution.”2

CrowdStrike partners Splunk and IBM are named in the 2020 Magic Quadrant for Security Information and Event Management report.

Splunk integrates CrowdStrike’s next-generation endpoint protection and threat intelligence into Splunk Enterprise Security (ES) to help organizations prevent, detect and respond to threats in real time. Deployment is rapid, scalable and enables faster detection and remediation of threats.

CrowdStrike and IBM together provide a holistic view into an organization’s threat landscape so users can behave proactively based on comprehensive visibility and automated intelligence.

How to maximize SIEM security software?

When evaluating a SIEM, Gartner recommends recommends “security and risk management leaders evaluating SIEM solutions must start by understanding and describing their scope as well as their use cases, and then defining specific requirements from these inputs in conjunction with applicable stakeholders.”1

Many organizations just use their SIEMs to track and investigate events that have already occurred. They are missing the real power of their SIEM: to detect and respond to threats in near real time. This is possible due to machine learning that helps SIEMs identify unusual activity as it occurs on systems throughout the environment.

To achieve maximum effectiveness, the right data must be defined and connected to the SIEM. The larger the data source that is fed into the SIEM, the higher the quality of the data it will return.

To increase efficiency, false alerts should be minimized by subjecting the SIEM to strong governance and appropriate procedures. It also must be tuned over time — but security teams must also be careful not to tune out too many alerts so they don’t inadvertently overlook real threats. To gain even greater efficiency, scripts can be written to automate low-level tasks, such as pulling data from different sources in the environment. A formal process should be used to integrate the SIEM with other technologies so that steps aren’t missed along the way.