Security information and event management (SIEM) software provides a way to track, integrate, and analyze the vast amount of log data that comes from an organization’s applications and network hardware. Its original value came from compliance reporting, but it is becoming an increasingly valuable tool for security.
In any organization, end-user devices, servers, network equipment, firewalls, and a host of other components continually generate log files, time-stamped lists of software actions and events. All events generate a record, but which events indicate something anomalous or malicious is often not immediately clear.
SIEM systems gather data from multiple locations to permit the detection of trends and patterns that might indicate a problem. SIEM grows out of earlier software called SIM (security information management) and SEM (security event management), and its first generation was back in the 1990s.
The original impetus for a SIEM solution was not security per se, but compliance. Organizations needed a way to meet the monitoring and reporting requirements of mandates such as HIPAA, Sarbanes Oxley, and particularly the Payment Industry Data Security Standard (PCI DSS). Collecting and analyzing the events captured by log files provided reports on non-compliant activities and policy violations, time-ordered event data for compliance auditing, and evidence of how well threat prevention efforts were working.
SIEM’s use for threat response has become relatively more important in recent years, but compliance reporting remains a key function.
Log files were developed on a case by case and system by system basis, and so lack a common standard. They are largely plain text, and are written to be readable by humans, not by computers. But the volume of them is far too large to be usefully read by anyone.
So one important SIEM process is to break all log files into common components and normalize them into a database table. SIEM vendors typically list the hundreds of log file formats they can automatically incorporate, updating the list regularly. A few allow for general integration of all log sources, at the cost of a lot of upfront work on the part of the administrator.
Many SIEM offerings now incorporate threat intelligence feeds (often from third parties) and provide additional security analytics to track network behavior as well as user behavior to distinguish between benign and malicious activity.
And the analytics included in SIEM packages are increasingly based on machine learning, statistical analysis, and other more sophisticated big data capabilities.
SIEMs generally offer automated response capabilities to block malicious activities in real time. These need to be configured by the organization to match its own implementation and environment.
Software, even sophisticated software, is only as effective as the underlying processes and workflows that it is tracking, supporting, and reporting on. In general, such software should be used to monitor and automate lower-level processes so that staff can focus on analysis, response, and planning—and in providing executive decision makers with a clear view of what is going on overall.
So anyone implementing a SIEM must focus on what the organization plans to accomplish. A clear understanding of how SIEM will help it accomplish those goals will give the software acquisition greater value. Smaller organizations should recognize their limited resources and identify the infrastructure essential to keeping the business running, and focus on those specific log files.
SIEMs make incident handling more effective. SIEMs often provide data visualizations and search functions to support this. They are a tool to managing existing security systems, and allow for a single view of network activity, over time providing a skilled operator with a more intuitive sense of system state.
SIEM users have typically been large enterprises, because of its cost and the cost of the skilled talent needed to get the full use of it. But its capabilities can be attractive to smaller organizations as well, as long as they can focus on business-critical functions for a cost-effective implementation.
Alex Jablokow is a freelance writer who specializes in technical and healthcare business. He blogs about the Internet of Things, software, inertial guidance systems, and other topics for business clients. Sturdy Words, his freelance content business, is at www.sturdywords.com.
Let our experts teach you how to use Sitefinity's best-in-class features to deliver compelling digital experiences.Learn More
Subscribe to get all the news, info and tutorials you need to build better business apps and sites
You can also ask us not to share your Personal Information to third parties here: Do Not Sell or Share My Info
We see that you have already chosen to receive marketing materials from us. If you wish to change this at any time you may do so by clicking here.
Thank you for your continued interest in Progress. Based on either your previous activity on our websites or our ongoing relationship, we will keep you updated on our products, solutions, services, company news and events. If you decide that you want to be removed from our mailing lists at any time, you can change your contact preferences by clicking here.