Why SIEM is essential for a successful security strategy

Vinod Kumar

Despite the proliferation of enterprise log management and event monitoring solutions, the overall state of information security has not measurably improved after incidents and audits. According to Gartner, the consumer security software market has actually shown a decline of 1.8% in 2014. However, among the sub-segments in security, the fastest growth has been witnessed by Security Information and Event Management (SIEM) at 11pc.

IT environments are growing more complex and difficult to manage so making use of SIEM technology is becoming more important than ever. Highly recommended by security experts and industry groups, SIEM technology has today become a vital component of an in-depth modern security strategy. SIEM provide a complete view of network security by gathering log and reporting structures in one place the information security pros need to identify threats. It can help organizations achieve other important goals such as legal compliance, information systems security, system health and forensic investigation.

How SIEM solves Bigger Business Issues

Attackers are often successful with soft targets where defenders do not review log and other security data. Consider the recent Anthem Blue Cross data breach which affected the records of 80 million current and former customers of the health care insurer. Hackers had accessed personally identifiable information (PII) including medical identification and social security numbers which had a very strong impact on customers’ personal lives.

An SIEM solution combines the benefits of SIM (Security Information Management) and SEM (Security Event Management) to centralize the storage and interpretation of logs and allow near real-time data analysis which enables security personnel to take defensive actions more quickly.

When it comes to gathering masses of security data that can be examined to bring significance to security events, SIEM is considered the most effective solution. It offers a comprehensive set of capabilities for gathering, analyzing and presenting information from network and security devices and proves quite effective in log auditing and incident response. Security managers can utilize the information to improve identity management, access control and vulnerability management of various applications over a network. This is a key reason why SIEM is gaining popularity among CISOs and CIOs for making key decisions related to security management.

Essential Features of an SIEM solution

While most SIEM’s have the ability to collect, store and analyze security data, the meaning that can be pulled from a data stored depends on how the data is reviewed. Given below are some ‘must have’ features of SIEM that you should keep in mind while selecting the right solution for your organization:

• Real-time event log monitoring to detect and respond to suspicious activities, Monitor security-relevant policies, mechanisms activities and applications
• Three-layer log data consolidation accessible through two-factor authentication, forensic investigations capabilities and compliance reporting
• Complete IT infrastructure monitoring and management of IT assets
• All relevant log data as per the security standards and regulations that can be is managed, collected, consolidated and safely stored for the actions occurring in their workplace
• An early warning system that enables administrators to take intrusion countermeasures
• A backup facility that thwarts whoever tries to cover their tracks by deleting log data
• Intelligent and configurable event processing rules that also detect malicious insider attacks
• Configurable alerting features that change administrator notification methods according to the time of day
• Regular auditing and reporting to senior management of successful and unsuccessful logons, as well as all attempts to access restricted files and directories
• Simplify regulatory compliance with SOX, PCI DSS, HIPAA, FISMA and other laws
• Cut costs and increase IT department's productivity by automating IT management
• Employee performance metrics can be used to measure employee resource use against configurable rules and rule sets in a single console.

The author is the managing director at Satcom Infotech