Upload
others
View
0
Download
0
Embed Size (px)
Citation preview
Become a hunter: fi nding the true value of SIEM.
2The value of SIEM
When Security Information and Event Management (SIEM) hit the security scene, it was heralded as
a breakthrough in threat detection. However, SIEM is just a tool. While initially designed to bring data
together for a more comprehensive threat view, it has become, like many other security technology
solutions before it, reactive and siloed. SIEM gains its true value when coupled with expertise, becoming
one tool in the proactive hunt for actionable intelligence.
SIEM is only as smart as the people analyzing its data.SIEM is an excellent technology, and it is core to any security architecture. However, on its own, SIEM is
still a reactive tool layered on top of other reactive data-generating tools.
For SIEM to function to its promise – enabling security analytics to provide actionable intelligence – the
technology must be coupled with people. It’s people that can build the use cases that give SIEM context.
It’s people who understand the enterprise environment globally. It’s people who can take that global view
and progress towards actionable intelligence.
If organizations start from the premise that they have been or probably will be breached, reacting is no
longer enough. Organizations must become proactive hunters, constantly mining data and seeking insight
that inspires action.
3The value of SIEM
Actionable intelligence leads to executable actions: one organization’s journey to SIEM value. A major Canadian retailer had multiple organizations providing segregated pieces of its security, including a
reactive SIEM service, intrusion prevention and fi rewalls. As a result of the siloed nature of the solutions, the
organization’s security team struggled to uncover actionable intelligence.
The security team was leveraging the SIEM solution. Its SIEM provider had built rules and correlations
around SIEM that triggered reactions to certain events and generated alerts that were forwarded to the
internal security team.
However, with many of its security technologies being managed independently, there was little cohesion
between the different providers and the organization, as well as between the data sources providing security
posture information.
It’s an error common to many organizations as security has evolved – different technologies, going in
different directions, with little to no communication or interaction. Without interaction, a global view is
impossible, which makes it challenging to effectively mine the data.
The SIEM investment had been made, and the solution was functioning to a degree. But the organization
was not realizing its true value because the internal security team was still in reactive mode, rather than
being a proactive hunter.
The retailer partnered with TELUS Security Solutions. TELUS security specialists made some simple
changes to consolidate key components of the retailer’s security environment. They confi gured the SIEM
solution to report and alert on things that the organization prioritized. They then took the data coming out
of the SIEM solution and applied advanced monitoring. The resulting outcome was twofold – the TELUS
security team was able to apply threat information to the data and wrap it within the context of the retailer’s
environment.
With this change, the retailer has transitioned to proactive hunter -- creating a process whereby all security
alerts, major and minor, are being reviewed on a consistent basis. The security team now has a mechanism
for taking billions of points of data and transforming those into actionable intelligence that leads to
executable actions.
4The value of SIEM
Advice for aspiring hunters.In security, defense is important. Collecting data is also important. But hunting is critical – looking for
anomalies, understanding their causes and investigating incidents and events. It’s important to have a plan
to hunt proactively and respond proactively. TELUS security experts provide three key pieces of advice.
Take a programmatic approach to security.
Maturing along the continuum to actionable intelligence requires a programmatic approach to security. You
can’t have one without the other. What does that mean? It means that your security program must be built in
a holistic way. Over time, most organizations have been adding siloed solutions to solve problems. However,
perpetrators don’t take a siloed approach to their attacks. They look at everything – all tools and processes.
Looking at security from a programmatic perspective enables you create an interconnection between tools,
processes and people. With that interconnection, you can correlate data from your entire infrastructure,
whittle it down and examine specifi c components in order to identify real issues with potential impact, which
may not have been evident when viewing individual silos.
Take the leap of faith away from reactive to proactive.
By defi nition, all technologies are reactive. They are designed to react to an event or multitudes of events.
Organizations that are serious about security are getting serious about being proactive in their approach.
The irony is that they thought they were being proactive by implementing reactive tools, yet they only initiated
more problems by creating technology silos. Proactive is defi ned differently now. With the architecture and
technologies in place and doing their thing, it’s critical to inspect the data coming from different technologies
to understand what’s happening globally in your environment and to hunt for anomalies.
Empower your SIEM solution.
The SIEM solution itself includes:
■ Device monitoring, management and maintenance
■ Security alert notifi cation
■ Device tuning and optimization (understanding false positives)
■ Central log collection
■ Use case development and deployment, created in partnership with the client or business unit
■ Report development and distribution
■ Custom device support
True actionable intelligence comes from advanced monitoring and security analytics – compiling
data from the SIEM solution, customer environment (e.g. industry, location, political environment)
and security in general to determine whether an event is truly a security event. To maximize
the value of the SIEM, it is critical to consider:
■ Proactive threat intelligence capabilities for data analytics
■ Proactive research and profi ling
■ Log analytics and monitoring
■ Data contextualization
■ The business, its people, technology and processes
1
2
3
5The value of SIEM
Moving beyond SIEM’s technology capabilities.SIEM falls short of expectations and fails to deliver value when it is leveraged only as a technology. To fi nd
the true value of a SIEM investment and to position it as an enabler of proactive hunting, it is important to:
■ Leverage the power of SIEM to build strong use cases that address organizational gaps
■ Understand the output of SIEM and use cases to provide an actionable response
■ Provide advanced monitoring and security analytics to leverage the data within the context of the organization’s security environment
If you are thinking of deploying SIEM technology or have already deployed but are struggling to realize the
value of actionable intelligence, visit telus.com/SIEM to learn more about our SIEM consulting and management services.