Security Information & Event Management

Security Information & Event
Management
Background on Network Components 2
 Router
 IPS/IDS
 Firewall
 Switch (L2 & L3)

 Servers (Application, Database, etc.)
 Demilitarized Zone (DMZ)

 Virtual Private Network
Defense in Depth 3
Typical Corporate Environment 4
Log Management 5
 Log management (LM) comprises an approach to

dealing with large volumes of computer-generated log
messages (also known as audit records, audit trails,
event-logs, etc.).
 LM covers log collection, centralized aggregation, long-
term retention, log analysis (in real-time and in bulk
after storage) as well as log search and reporting.
Log Management 6
Log Management Challenges 7
 Analyzing Logs for Relevant Security Intelligence

 Centralizing Log Collection
 Meeting IT Compliance Requirements
 Conducting Effective Root Cause Analysis
 Making Log Data More Meaningful
 Tracking Suspicious User Behavior
Introduction to SIEM 8
 The term Security Information Event Management

(SIEM), coined by Mark Nicolett and Amrit Williams of
Gartner in 2005.
 Describes the product capabilities of gathering,
analyzing and presenting information from network and
security devices; identity and access management
applications; vulnerability management and policy
compliance tools; operating system, database and
application logs; and external threat data.
Introduction to SIEM 9
 Security Information and Event Management (SIEM) is a term for

software and products services combining security information
management (SIM) and security event manager (SEM).
 The acronyms SEM, SIM and SIEM have been sometimes used
interchangeably.
 The segment of security management that deals with real-time
monitoring, correlation of events, notifications and console views
is commonly known as Security Event Management (SEM).
 The second area provides long-term storage, analysis and
reporting of log data and is known as Security Information
Management (SIM).
Key Objectives 10
 Identify threats and possible breaches

 Collect audit logs for security and compliance
 Conduct investigations and provide evidence
SIEM vs LM 11
Functionality Security Information and Event Log Management (LM)

Management (SIEM)
Log collection Collect security relevant logs + context Collect all logs
data
Log pre-processing Parsing, normalization, categorization, Indexing, parsing or
enrichment none
Log retention Retail parsed and normalized data Retain raw log data
Reporting Security focused reporting Broad use reporting

Analysis Correlation, threat scoring, event Full text analysis,
prioritization tagging
Alerting and Advanced security focused reporting Simple alerting on all
notification logs
Other features Incident management, analyst workflow, High scalability of
context analysis, etc. collection and storage
Why is SIEM Necessary? 12
 Rise in data breaches due to internal and external

threats
 Attackers are smart and traditional security tools
just don’t suffice
 Mitigate sophisticated cyber-attacks
 Manage increasing volumes of logs from multiple
sources
 Meet stringent compliance requirements
Elements of SIEM 13
Monitored Events
Event Collection
Core Engine
User Interface
Typical Features of SIEM 14
BIG 3 for SIEM 15
Compliance
SIEM
Security Operations
SIEM Process Flow 16
Extract Presentation
Data
Intelligent Add Value Dashboards
Collection
Information & Reports
Typical Working of an SIEM Solution 17
SIEM Architecture
18
System Inputs
Event Data Contextual Data

Operating Systems Vulnerability Scans
Applications User Information
Devices Asset Information
Databases Threat Intelligence
Data
SIEM Correlation
Collection Logic/Rules
Normalization Aggregation
System Outputs
Analysis
Reports
Real Time Monitoring
Context 19
Adding Context 20
 Examples of context
 Add geo-location information
 Get information from DNS servers
 Get User details (Full Name, Job Title & Description)
 Add context aids in identifying
 Access from foreign locations
 Suspect data transfer
21
8 Critical Features of SIEM

#1. Log Collection 22
 Universal Log Collection

 To collect logs from heterogeneous sources
(Windows systems, Unix/Linux systems,
applications, databases, routers, switches,
and other devices).
 Log collection method - agent-based
or agentless
 Both Recommended
 Centralized log collection
 Events Per Second (EPS) – Rate at
which your IT infrastructure sends
events
 If not calculated properly the SIEM solution will
start dropping events before they are stored in
the database leading to incorrect reports,
search results, alerts, and correlation.
#2. User Activity Monitoring 23
 SIEM solutions should have Out-of-

the-box user activity monitoring,
Privileged user monitoring and audit
(PUMA) reporting feature.
 Ensure that the SIEM solution gives
the ‘Complete audit trail’
 Know which user performed the action, what
was the result of the action, on what server
it happened, and user workstation/device
from where the action was triggered.
#3. Real Time Event Correlation 24
 Real-time event correlation is all

about proactively dealing with
A threats.
 Correlation boosts network security
by processing millions of events
simultaneously to detect anomalous
events on the network.
D B  Correlation can be based on log
search, rules and alerts
 Predefined rules and alerts are not
sufficient. Custom rule and alert builder is a
C
must for every SIEM solution.
 Ensure that the process of correlating
events is easy.
#4. Log Retention 25
 SIEM solutions should automatically

archive all log data from systems,
devices & applications to a
‘centralized’ repository.
 Ensure that the SIEM solution has
‘Tamper Proof’ feature which
‘encrypts’ and ‘time stamps’ them
for compliance and forensics
purposes.
 Ease of retrieving and analyzing
archived log data.
#5. IT Compliance Reports 26
 IT compliance is the core of every

SIEM solution.
 Ensure that the SIEM solution has
out-of-the-box regulatory compliance
reports such as PCI DSS, FISMA,
GLBA, SOX, HIPAA, etc.
 SIEM solutions should also have the
capability to customize and build new
compliance reports to comply with
future regulatory acts.
#6. File Integrity Monitoring 27
 File integrity monitoring helps security

professionals in monitoring business
critical files and folders.
 Ensure that the SIEM solution tracks
and reports on all changes happening
such as when files and folders are
created, accessed, viewed, deleted,
modified, renamed and much more.
 The SIEM solution should also send
real-time alerts when unauthorized
users access critical files and folders.
#7. Log Forensics 28
 SIEM solutions should allow users to

track down a intruder or the event
activity using log search capability.
 The log search capability should be
very intuitive and user-friendly,
allowing IT administrators to search
through the raw log data quickly.
#8. Dashboards 29
 Dashboards drive SIEM solutions

and help IT administrators take
timely action and make the right
decisions during network anomalies.
 Security data must be presented in a
very intuitive and user-friendly
manner.
 The dashboard must be fully
customizable so that IT
administrators can configure the
security information they wish to see.
30
Deployment Options
Self-Hosted, Self-Managed 31
Self-Hosted, MSSP-Managed 32
Self-Hosted, Jointly-Managed 33
Cloud, MSSP-Managed 34
Cloud, Jointly-Managed 35
Cloud, Self-Managed 36
Hybrid-Model, Jointly-Managed 37
Why SIEM implementation fails? 38
 Lack of Planning
 No defined scope
 Faulty Deployment Strategies
 Incoherent log management data collection
 High volume of irrelevant data can overload the system
 Operational
 Lack of management oversight
 Assume plug and play
“Security is a process, not a product”

Business Benefits 39
 Real-time Monitoring
 For operational efficiency and IT
security purposes
 Cost Saving
 Compliance
 Reporting
 Rapid ROI
40
Q&A
41
THANK YOU

Security Information & Event Management

Uploaded by

Copyright:

Available Formats

Security Information & Event Management

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security Information & Event Management

Uploaded by

Copyright:

Available Formats

What are the main components of a typical corporate network?

What are the main components of a typical corporate network?

What is the difference between SIEM and log management functionality?

What is the difference between SIEM and log management functionality?

Security Information & Event

 Switch (L2 & L3)

 Demilitarized Zone (DMZ)

 Log management (LM) comprises an approach to

 Analyzing Logs for Relevant Security Intelligence

 The term Security Information Event Management

 Security Information and Event Management (SIEM) is a term for

 Identify threats and possible breaches

Functionality Security Information and Event Log Management (LM)

Reporting Security focused reporting Broad use reporting

 Rise in data breaches due to internal and external

Event Data Contextual Data

8 Critical Features of SIEM

 Universal Log Collection

 SIEM solutions should have Out-of-

 Real-time event correlation is all

 SIEM solutions should automatically

 IT compliance is the core of every

 File integrity monitoring helps security

 SIEM solutions should allow users to

 Dashboards drive SIEM solutions

“Security is a process, not a product”

You might also like