What is SIEM and why does it matter today?

What is a SIEM system utilized for?

To understand SIEM, it is first useful to grasp the trends and pressures that make it valuable. SIEM technology became necessary because companies must deploy so many different types of devices and applications, all of which need monitoring and protection from a security perspective.

Today’s complex IT environments have made the need for SIEM unavoidable, because it is used to interpret massive volumes of otherwise incomprehensible data taken from applications and devices. It distills mountains of information down to a more manageable list of to do’s for the team on the receiving end.

How does SIEM work?

Insights into the IT environment

SIEM gives SecOps insights into activities within the network and IT environment. A SIEM solution achieves this goal by analyzing device and software log data, flagging alerts and using advanced analytics to detect threats. The solution then notifies SecOps stakeholders as dictated by rules programmed into the system.

A centralized view for correlating events

A SIEM solution collects data on antivirus events, firewall logs and other log sources and puts it all together in a centralized platform. Once the SIEM solution has all the data in a central place, it can correlate events and discover possible security vulnerabilities or security incidents. A SIEM software usually accomplishes these objectives through custom analytics, dashboards and customizable alert workflows.

Analytics help identify and flag suspicious activity

For example, the SIEM solution might discover malware on a device. Then, through data correlation, the solution can match the malware with an IP address connected to multiple failed login attempts. SIEM will utilize sophisticated rules to determine if this discovery represents a serious threat.

A user trying to log into her account five times in an hour from a known and trusted IP address is normal. If the same user tries to log in 500 times in an hour from an unknown IP address, that suggests that an attack is in progress—and that the user’s account has most likely been compromised. For this to work, the solution must perform data normalization across the many disparate data sources that feed into it.

Why is SIEM important?

While some people believe that SIEM is becoming obsolete, the technology is still very much relevant and needed in today’s SecOps. As the threat environment grows increasingly dangerous, it is more important than ever to have advanced security data analytics capabilities.

For example, it may only be possible to detect a “zero day” attack with detailed, real-time analysis and correlation of multiple logs. There are few alternative solutions, at least ones that offer the kind of efficiency of SIEM. Furthermore, SecOps staffers tend to be overworked, so the centralization of data and analytics is essential to their success in protecting digital assets.

What are the challenges of SIEM?

SIEM has had a reputation for being complex and difficult to set up, but much of that reputation is out of date. Modern SIEMaaS and fully managed solutions help alleviate operational issues. Many SIEM solutions require tuning to avoid an excessive number of false positives. Setup and tuning may require a high level of skill, which can be outsourced via a fully managed SIEMaaS solution.

As an advanced technology SIEM helps to take over and do some of the security work automatically, but not everything is automated. For instance, human resources and IT staffers are needed to help stay on top of the SIEM log tracking, which is a critical step in security success. This is a common problem, as many companies struggle with expanding their security operations to accommodate and operationalize the SIEM technology. Fully managed services can help with this. Learn more about fully managed security services from Masergy.

New tools are complementing SIEM technologies, helping to further automate SecOps. As SIEM issues alerts to the IT team, the handoff between noticing a security event and acting on it can sometimes lead to inefficient manual processes, delays, or even errors. This is where Security Orchestration, Automation and Response (SOAR) solutions come into play.

SIEM technologies vs. SOAR technologies

SOAR solutions automate security incident response workflows. This may also involve orchestrating incident response process steps among different systems. For example, a SOAR solution might automatically notify key stakeholders if there is a serious security event. In parallel, it might automatically look up the threat from an intelligence database and automatically generate a service ticket that includes that threat detail—all so security analysts do not have to spend any extra time on routine, manual tasks like sending emails and updating tickets. They can respond quickly and do what human beings do best, like making subjective judgement calls and communicating about complicated issues. The machines do the rest.

SIEM and SOAR have a natural fit, which means the two solutions must integrate to be fully effective.

The SIEM solution initiates an alert, and SOAR activates the incident response process. However, in reality, these two solutions have begun to overlap in terms of features. Some SIEMs offer incident response automation. Some SOARs provide in-depth log and security information analysis. There is some confusion about which solution does what. In general, though, it’s probably a best practice to have both a SIEM and a SOAR in operation. However, this doesn’t necessarily mean you have to purchase both technologies outright. If you outsource your security incident response services, just make sure your provider is already using a SOAR system to accelerate the pace of their security analysts–meaning your threat response efforts.

What is cloud-based SIEMaaS?

SIEM-as-a-Service offers SIEM functionality delivered from a cloud-hosted SIEM solution. Instead of installing a SIEM appliance or SIEM software locally, users can rely on an off-site, on-demand SIEM solution. This approach offers several advantages. It takes away the challenges of setting up and tuning the SIEM, which can be daunting. It also handles the frequently high-volume data storage and management requirements that come with SIEM.

The value of a fully managed SIEMaaS, backed by SOC Services

It is also possible to take SIEMaaS a step further by outsourcing the entire SIEM operation and related Security Operations Center (SOC). In this scenario, the day-to-day operation of the SIEM is handled by the SIEMaaS provider and their certified security analysts. This reduces pressure on the client and their in-house SecOps teams, freeing them to focus on strategic security planning and other value-add activities.

What are the benefits of SIEM?

SIEM plays an important role in a company’s overall cyber defense. The technology is unique in its ability to parse and interpret massive volumes of data. It can detect attacks and threats that might be impossible to detect through other means. SIEM can be challenging, though, with skilled personnel required to implement and manage the solution, the heightened protection is well worth the investment.

SIEMaaS offers a sense of peace of mind given today’s increasing security risks. With a cloud-hosted SIEM solution, and the added relief of a fully managed solution, it becomes possible to enjoy the benefits of SIEM without having to worry about its challenges and shouldering the human resources burden that typically comes with the technology.