Sidebar: Avoid these six SIEM pitfalls

Security information and event management (SIEM) suites can be valuable when implemented and configured right — and security teams are trained to make the best use of them. Still, failures and stalled deployments are common. Gartner analyst Oliver Rochford offers these pitfalls and how not to fall into them:

Failing to plan before buying

Although SIEM solutions share a common capability and feature set, for example they are all competent at log management, third rd party technology support, workflow and deployment architectures do vary widely. As a consequence, buyers often select the “best” solution based on high level criteria such as fancy features, resulting in a mismatch of requirements when it comes to implementation. Instead, CISO should follow a formalized planning approach.

Failing to define scope

This means identifying the primary objective, Compliance or Threat Management for example, and the resulting security technologies and associated use cases.

Overly-optimistic scoping.

Many organizations assume that they can monitor their entire environment from day one. In reality, this has to be done in a phased manner, implementing a small amount of technologies and use-cases at a time to allow for the creation of correlation rules, dashboards and reports, as well as performance optimization and troubleshooting.

Failing to monitor noise

SIEM is not Log Management, where all and sundry logs are collected and stored for compliance and forensics. Instead it relies on correlation rules that depend on specific logs and events to detect threats. Collecting logs indiscriminately impacts performance, adds noise and does not improve detection. Instead we recommend selective forwarding of specific logs as required on a use case by use case basis.

Lack of sufficient context

By themselves, many event types are difficult to assess and analyze. To provide an example, a user accessing a server may not seem like a risk, but if the user is employed in HR and is accessing a server in research and development, it may indicate malicious activity. This requires organizational context, which should be integrated into the SIEM.

Inadequate staffing

The last pitfall is sadly the most difficult to solve. Many organizations buy a SIEM without considering the required manpower. The SIEM itself has to be managed and maintained, and the task of monitoring also requires eyes on the logs or regular reviews of reports. While we are aware of some organizations running SIEM with one to two full time employees, to utilize it more broadly we recommend at least four. Round the clock realtime monitoring requires a minimum of 12 people. In cases where that is beyond the available budget, CISO’s should consider a managed security services provider.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@]

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now