Security Information Event Management
By Bozidar Spirovski, CISSP, MCSA, MCP
Security Information Event Management is the echoing buzzword in most industries these days.
Banking, Telecommunications, Power and Energy - anyone and everyone is under internal audit and regulator scrutiny to implement a Security Information Event Management system.
But most Security Information Event Management implementations are rushed and placed only to shut up the auditors and to go on as usual.
Since it’s a compliance requirement, the Security Information Event Management salespeople very rarely address whether the customer makes proper use of the solution, and whether this solution brings benefits to the company.
The common issue
SIEM is a Security Officer tool, but since it tightly integrates with IT equipment, the SIEM implementation is usually left to IT departments.
The issue with this is that IT will approach the implementation from a purely technical aspect: how to properly connect the IT equipment to the SIEM system.
Once the SIEM system is collecting audit logs and events from all required IT elements, the job is done. At most, a retention policy and archiving is also done by IT, and the story ends there.
The real benefit
Any SIEM system is simply a large database collecting massive amounts of events.
But if one does not use these events, the system is placed there just as a form, and brings only costs to the company. Here is what you’ll need to set-up to achieve benefits of a SIEM system
- Choosing what is most important to be alerted about - While some automated alerts and analysis are available within all SIEM systems, the generic alerts are rarely well matched to a company. For example, a generic alert may be triggered by consecutive failed attempts followed by a successful logon, but may not be triggered on a configuration change of a firewall. The first event was merely an employee trying to remember his password, and the config change of the firewall just opened up your network to some attack
- Alerting the proper person/team - The alerting means nothing if the alert does not arrive to the proper person to react in the fastest possible time. A ‘transaction log is full’ means little to a network admin just as SYN flood may mean absolutely nothing to the DBA. And both will mean not too much to the head of the department, if one chooses to send all alerts to the manager.
- Creating and using the proper reports - Some SIEM systems come bundled with reports, other sell the reports as packages. But the vanilla flavour reports may not always be useful to the organization, so the correct report definition should be prepared and implemented during the SIEM implementation. This way the company will know that these reports are to their specification, and even more, that the data needed for this report is collected by the SIEM system.
Author: Bozidar Spirovski of Information Security Short Takes
- Occupation: Information Security Expert
- CISSP #301565
- MCSA, MCP ID# 2448347
- Send comments, requests or general inquiry to shortinfosec _at_ gmail dot com
- Visit my LinkedIn profile at http://www.linkedin.com/in/spirovskibozidar
* * *
Stay Informed With ISR News Feeds and Email Alerts Here:
The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
Filed under: Bozidar Spirovski, Breach, D&O Liability, FEATURE ARTICLE, Financial, PCI, Sarbanes-Oxley, Uncategorized, hackers, identity-theft, national security, privacy
Comments
Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
