Security Information and Event Management (SIEM) Solutions Essay

Table of Contentss

Introduction

Background

Analysis and Discussion

Decision

Mention

Introduction

Security Information and Event Management ( SIEM ) is a engineering that enables security analyst or web decision maker to place and describe on security menaces or any leery activity by roll uping logs from informations across assorted webs applications and devices. Menaces can happen internally or externally at any clip which could do major harm and cost to the organisation. With engineering going progressively complex and security exposures going really hard to manage and observe, organisations are passing important clip, energy, and money inspecting their security and event logs to place which particular system has been accessed by which single and what action or activity has happened during the procedure. Organizations are looking towards a different method of attack like machine-controlled systems to assist ease the sum of concern organisation has. As a consequence, the outgrowth of SIEM has proved to manage those menaces by bettering the sensing and response consequences but some organisations have uncertainties sing the capableness of SIEM, whether if the engineering would supply sufficient security and protection that is good to security analyst. SIEM has been quickly turning in footings of supplying legion organisations the map to assist decision makers observe web menaces and prevent hereafter happenings from go oning. SIEM is by and large used to supply a position of the organisation security events such as centralized log-handling by roll uping logs from assorted devices and applications of a web, every bit good as analysis and informations storage. If the system is under onslaught, it can respond by alarming the security analyst or web decision maker to forestall any farther harm to the web systems. This study provides a clear apprehension of SIEM solutions and whether it can assist heighten invasion sensing and response. The background will give an overview of SIEM and how it got started. The analysis subdivision will show the SIEM maps in elaborate and so the decision will supply a summarized remark on the study ( Ben Rothke, 2011 ) .

Background

SIEM has emerged to the market place when organisation found out that they have been passing a immense sum of money on IDS/IPS ( intrusion detection/prevention systems ) . The “World Security Information and Event Management ( SIEM ) and Log Management Products Market, ” ( Frost and Sullivan, 2010 ) announces that SIEM markets earned worldwide grosss of $ 678.1 million in 2009 and predicts that the figure will lift to $ 1.3billion in 2015. Historically, SIEM has driven the market to a point where organisations are on high demand for SIEM engineering to be implemented into their systems ( Tim Wilson, 2011 ) .

SIEM originated from two really distinguishable engineerings called security information direction ( SIM ) and security event direction ( SEM ) . The security information direction ( SIM ) constituent offers automated aggregation of log files from security devices such as firewalls, direction sensing systems, and antivirus package into a cardinal depository. SIM so translates the logged files into simplified formats. SIM besides offers historical coverage and a deep forensic analysis of informations from host applications and systems ( Forrest Stroud, no day of the month ) . Security event direction ( SEM ) constituent improves security incident response capablenesss. It deals with real-time coverage of informations from web applications and devices to supply near existent clip event direction for security operations. This process allows security analyst to be more equal in reacting to internal and external menaces. SEM assists significantly with Advanced Persistent Threats ( APT ) , standardization, and consolidates monitored informations together to assist short-circuit any missing critical events ( IntiGrow, 2012 ) .

All these maps are joined into one security direction system ( SEIM ) that describes the engineering abilities to garner, analyze and present information from web and security devices. The nucleus capableness of SIEM is the ability to correlate and analyse events across different beginnings and a have wide range of event aggregations ( Gartner, 2013 ) . Having all these maps in a centralised platform allows system analysts to supply the undertaking of roll uping, correlating, and analysing informations efficaciously and easy ( Margaret Rouse, 2012 ) .

Analysis and Discussion

It is believed that the most compelling ground for organisations to utilize SIEM is to cut down the sum of security threats/events and to analyse and forestall existent onslaughts and unauthorised interlopers. An organisation may hold 1000s of extremely trained employees to supervise event logs and place menaces but what SIEM can supply is an machine-controlled procedure that can accomplish a echt decrease of security event informations. It really escalates more efficaciously compared to manual sensing human monitoring. This is the ground why SIEM is sooner used by most organizations/companies.

Having 1000s of events generated per twenty-four hours, no affair how good trained the security analyst is, managing that many events is really hard to cover with. It could do confusion and human mistake which so would be a good thought to implement SIEM into the organisations system. SIEM provides legion benefits to security analyst to analyse and observe unusual behaviour in real-time and capturing informations on web systems. With the information presented by SIEM, organisations can make up one’s mind the following phase to forestall, and respond to the menace by roll uping, correlating, analysing, and pull offing invasion sensing system/intrusion bar system qui vives. However critics say that they are nil more than automated log aggregations and collection tools that offer really small benefit to security analysts ( Matt Harrigan, 2013 ) .

But there is a immense difference between SIEM and a standard log aggregation tool. For illustration, SIEM works by roll uping different formats of log informations from assorted beginnings which are so normalized into a proprietary format which is known as the consolidation procedure. The analyzed information is so combined from assorted devices and is correlated by aggregating different parts of an onslaught into a complete description. Information about web environment and menaces at this phase is really utile whereby studies and qui vives are generated as a consequence. The generated log informations is so stored on the SIEM until it is moved to an archive and it is so saved whereby the information might be utile for forensic probe. A standard log aggregation tool does non lend or execute such maps or present studies and qui vives in such manner which assist the security analyst ( Dominique Levin, 2009 ) .

SIEM provides legion advantages that enhance invasion sensing and response, advantages such supplying speedy forensic analysis by seeking through specific log data’s across 1000s of devices on different nodes and clip periods. This characteristic provides the system analyst an easier undertaking than holding to memorise log information or holding to seek through multiple log data’s. SIEM besides support by implementing durable depository of historic informations to hasten correlativity of informations over clip. SIEM besides provides tools that collects event informations and detects activity that is unnatural. It so transforms the informations and nowadayss it in a graphical tabular array to aids security analyst in distinguishing normal and unnatural forms from reported log data’s and events. Configuration alterations on web equipment’s can besides be exactly presented in a graphical format. SIEM can supervise security equipment’s like firewalls, IDS/IPS, etc. and besides logs of web gateway devices.

Furthermore, system analysts are able to analyse the beginning of mistakes or security invasion utilizing SIEM. By seeking the studies and log information it collected from 1000s of devices, system analysts can place what caused the mistakes. Mistakes like constellation alterations and web breaches can find which system is vulnerable. SIEM besides ensures that all software’s like anti-virus and operating systems are up to day of the month and has all the latest spots applied. If a system is in critical mistake, SIEM will observe the accomplished system and continuously supervise its wellness and study on any system outages when it occurs.

Additionally, SIEM can supervise user with multiple failed logins and user with unauthorised system entree. It can besides be used for server entree monitoring to find if there has been any illegal activity or choping involved internally or externally. Internal staffs are besides monitored whereby SIEM can place and find who, what, and when it was accessed in a server/application. Other than placing internal staff actions, SIEM can place which system in the web has been affected by malware and if they are distributing to other systems in the webs ( Rajesh K, 2010 ) .

By now it should be clearly understood that SIEM does non decrease menaces, it helps the decision maker identify web menaces by utilizing techniques such as correlativity of informations from multiple devices so that appropriate actions could be taken. Among all the characteristics and advantages SIEM provides, it proves to demo that SIEM genuinely enhances invasion sensing and response compared to other standard log aggregation or collection tools.

Decision

As engineering progresss, security menaces become more complicated and unsafe. Software’s and engineering has to be kept updated often to forestall any malicious onslaughts. Therefore in a technological market, the involvements for security information and event direction ( SIEM ) tools will increase efficiently. SIEM are complex tools and has a batch of independences with different systems and security steps. SIEM requires preparation or a high degree proficient expertness to keep and manage the system. SIEM becomes more active when it can be applied to log based activity informations and security related events correlated to other concern issues. Multiple organisations are already utilizing the tool to heighten the security of Web 2.0 applications, nomadic devices, and even cloud-based services. Therefore, there is no uncertainty that SIEM solutions help heighten the invasion sensing and response.

Mention

1. Ben Rothke, 2011,Security Information and Event Management ( SIEM ) Implementation,Available from: hypertext transfer protocol: //www.infosecisland.com/blogview/12105-Security-Information-and-Event-Management-SIEM-Implementation.html [ online ] [ Accessed day of the month: 1^stNovember 2014 ]
2. Dominique Levin, 2009,The convergence of SIEM and log direction,Available from: hypertext transfer protocol: //www.networkworld.com/article/2265290/tech-primers/the-convergence-of-siem-and-log-management.html [ online ] [ Accessed day of the month: 6^ThursdayNovember 2014 ]
3. Forrest Stroud, no day of the month,security information direction, Available from: hypertext transfer protocol: //www.webopedia.com/TERM/S/security_information_management.html [ online ] [ Accessed day of the month: 4^ThursdayNovember 2014 ]
4. Frost and Sullivan, 2010,World Security Information and Event Management ( SIEM ) and Log Management Products Market,Available from: hypertext transfer protocol: //www.frost.com/sublib/frost-content.do? sheetName=report-overview & A ; sheetGroup=N861-01-00-00-00 & amp ; viewName=virtual-brochure & amp ; repid=N861-01-00-00-00 [ online ] [ Accessed day of the month: 1^stNovember 2014 ]
5. Gartner, 2013,Security Information and Event Management ( SIEM ) ,Available from: hypertext transfer protocol: //www.gartner.com/it-glossary/security-information-and-event-management-siem [ online ] [ Accessed day of the month: 4^ThursdayNovember 2014 ]
6. IntiGrow, 2012,Security Information and Event Management,Available from: hypertext transfer protocol: //www.intigrow.com/security-information-and-event-management.html [ online ] [ Accessed day of the month: 3^rdNovember 2014 ]
7. Margaret Rouse, 2012,security information and event direction ( SIEM ) ,Available from: hypertext transfer protocol: //searchsecurity.techtarget.com/definition/security-information-and-event-management-SIEM [ online ] [ Accessed day of the month: 6^ThursdayNovember 2014 ]
8. Matt Harrigan, 2013,The Challenges of Threat Detection in a Changing Landscape, Available from: hypertext transfer protocol: //packetsled.com/category/blog/ [ online ] [ Accessed day of the month: 6^ThursdayNovember 2014 ]
9. Rajesh K, 2010,An Introduction to SIEM – Security Information & A ; Event Management,Available from: hypertext transfer protocol: //www.excitingip.com/920/an-introduction-to-siem-security-information-and-event-management/ [ online ] [ Accessed day of the month: 6^ThursdayNovember 2014 ]
10. Tim Wilson, 2011,SIEM Market To Double By 2015, Report Says,Available from: hypertext transfer protocol: //www.darkreading.com/siem-market-to-double-by-2015-report-says/d/d-id/1135444 [ online ] [ Accessed day of the month: 1^stNovember 2014 ]