More often than not, enterprises believe that their SIEM (Security Information and Event Management) technologies are failing. Yet, the problem lies in how the SIEM solution is implemented.
According to a Cisco cyber security threat and protection report, ‘Only 58% of security alerts in the UK are investigated. Of those, 45% are legitimate, but only 55% of legitimate alerts are remediated.’
A SIEM is a powerful tool, but when implemented incorrectly, it fails to detect or prioritise common and damaging threats. For those who are unfamiliar with what a SIEM is, let us touch upon the basics first.
What is a SIEM?
A SIEM is a single user interface technology that allows users to evaluate alarms, investigate potential threats and respond to incidents. It provides context by centralising data from organisational assets and offers an end-to-end workflow, which reduces the mean time to detect (MTTD) and respond to threats. It also improves the overall security position of an organisation by using log data for security intelligence and analytics.
Why do you need a SIEM?
A SIEM offers security professionals the means to track, record and gain insight into IT networks. All logs are sent to a centralised server where security professionals gain insight into the organisation’s infrastructure. They use the SIEM tool to analyse, correlate and aggregate events, and then report this information.
A SIEM enables incident detection that would normally go unnoticed even as part of a security event log. It can analyse and correlate log entries to identify signs of malicious activity.
With companies needing to comply with GDPR and PCI-DSS, a SIEM is a great tool to adhere to compliance requirements. Failing a compliance audit entails not just loss of business, but also exorbitant fines. Companies that utilise a SIEM demonstrate that they are proactively monitoring systems that contain sensitive data.
So where else does a SIEM solution add value? It helps with incident management, enhancing the efficiency of incident handling, saving time and resources to contain the incident quickly and reduce overall damage. It improves efficiency by:
- Quickly identifying an attack route on the network
- Identifying all sources affected by a specific attack
- Providing valuable information to security teams to contain ongoing attacks
How a SIEM maturity assessment helps
An effective way to understand the weaknesses in your SIEM solution involves conducting a SIEM maturity assessment. A common cause of failing SIEM solutions can be found in the building blocks of a SIEM deployment. Incorrectly configured data sources and a poorly configured SIEM can lead to a ‘garbage in garbage out’ scenario. A SIEM maturity assessment will help identify and correct these faulty data sources and configurations.
At Mastek, our cyber security professionals use a score-based system and industry best practices to assess the effectiveness of your current SIEM. We review logging policies, assess use-cases specific to your business and recommend ways to improve regulatory compliance.
Contact us at info@mastek.com to find out how we can help your organisation detect cyber threats.
