1. Security event management (SEM): Analyzes log and event data in real time to provide threat monitoring, event correlation and incident response. Data can be collected from security and network devices, systems and applications.
2. Security information management (SIM): Collects, analyzes and reports on log data (primarily from host systems and applications, but also from network and security devices) to support regulatory compliance initiatives, internal threat management and security policy compliance management.
Traditional SEM vendors have responded by orienting products previously geared toward real-time event alerting and management toward log management functionality. For instance, ArcSight added its Logger appliance and additional deployment options to address compliance. Meanwhile, SIM players such as SenSage and LogLogic are adding real-time capabilities.
Jon Oltsik, an analyst at Enterprise Strategy Group, sees the market differently. The main driver, he says, is the need to keep up with security complexity. “There is an acute awareness that security attacks are more sophisticated and that security at a system level is harder than at the device level,” he says. Compliance is the second most important factor, he says, and the third is the need to replace early SIEM platforms that don’t scale or provide the right level of analytics and reporting capabilities.
Forrester expects consolidation among the 20-plus SIEM vendors in the next 12 to 36 months, as well as more cloud-based SIEM services.
Core Capabilities
According to Gartner, five critical capabilities differentiate SIEM products, whether you use them for SEM, SIM or both.
This includes functions that support the cost-effective collection, indexing, storage and analysis of a large amount of information, including log and event data, as well as the ability to search and report on it.
Reporting capabilities should include predefined reports, ad hoc reports and the use of third-party reporting tools.
Key capabilities include user and resource access reporting.
This includes real-time data collection, a security event console, real-time event correlation and analysis, and incident management support.
The need for compliance has encouraged smaller security staffs to adopt SIEM, and these buyers need predefined functions and ease of deployment and support over advanced functionality and extensive customization.
Large volumes of event data will be collected, and a wide scope of analysis reporting will be deployed. This calls for an architecture that supports scalability and deployment flexibility.
Access Monitoring. This capability defines access policies and discovers and reports on exceptions. It enables organizations to move from activity monitoring to exception analysis. This is important for compliance reporting, fraud detection and breach discovery.
SIEM DOs and DON’Ts DO include multiple stakeholders.
When developing requirements, be sure to collect them from the range of groups that may benefit from collected log data. This includes internal auditors, compliance, IT security and IT operations.
There are certainly customers just looking for log management because of a compliance requirement, and they may not have the internal resources to do anything but collect and document logs, Kavanaugh says. “But many buyers realize the capabilities inherent in log management software—the ability to collect, search and run reports—are valuable to security operations.” Once the security group gets involved, he says, they look at including network security devices, routers and other areas of the network environment where they don’t have great insight, as well as the real-time component.
When selecting a SIEM product at Liz Claiborne, Mike Mahoney, manager of IT security and compliance, involved architecture leaders from eight groups, asking them to respond to an in-depth questionnaire regarding what would help them improve their jobs. It ultimately took six months to complete the evaluation. “I wanted this to be a tool they would benefit from beyond log collection,” Mahoney says.
“Ultimately, the point of intersection is log management, but analytics might be done by two different platforms,” Oltsik says. “Whether you need security or compliance, you’re using the same log data.”
Correlation is a key aspect of SIEM systems, says Larry Whiteside, associate director of information security at the Visiting Nurse Service of New York (VNSNY). SIEM systems normalize logs from various systems, which helps you see the most important data you need out of those logs in a readable format. They also help you correlate events that the human eye could never perceive but that correlation rules can detect. “If you use correlation rules, you can run a report, and two events that are 10 minutes apart will be right on top of each other because they’re directly related to each other,” Whiteside says. He can also look at specific databases on specific servers and see who’s touching them. Or he can get log events to see what applications are talking to other applications and what database tables they’re hitting.For instance, if Server A is talking to Server B, and activity peaks on Sunday night at 10 p.m., he can drill in further to see what desktops are involved.
While software is the traditional form factor, Kavanaugh says, vendors have increasingly come out with all-in-one appliances, which do the data collection, analysis and correlation and use their own built-in databases to store copies of logs.
There are also many blended offerings, in which a server performs the real-time analysis, correlation and monitoring, and an appliance covers log collection.
Cincera warns that hardware and software accounts for one-half or less of the total cost of ownership of a SIEM implementation. The rest, he says, is the labor involved with creating, building and deploying the technology. “You can’t just put someone on the console and have them whip up 10 good correlation rules a day,” he says. “They need to understand things like, ‘These events need to be treated in this manner, or with this level of discretion.’ ” This requires the governance function to specify which events to care about and what actions to take. … There’s a cost to the organization based on that function,” Cincera says.
Another cost is maintenance, which includes keeping rules up to date, group management, permissions, alerting, monitoring and metrics. “You need to manage interfaces to upstream systems, things that feed information to the engine,” Cincera says. “You need to stay constantly involved, making sure connections stay in sync with one another, and that can be a daunting effort.” The work level grows dramatically based on the number of upstream systems you need to feed, he warns. “Every event you choose not to ignore is one on which you must act, even if it’s just to say, ‘noted,’ ” Cincera says. At some point, Cincera says, the rules, alerts and actions you take lose value and should be decommissioned.
Total cost of ownership is something no vendor is good at communicating, he adds. “They don’t want you to think of all those costs.”
http://www.csoonline.com/article/509553/Choosing_SIEM_Security_Info_and_Event_Management_Dos_and_Don_ts