Security information and event management (SIEM) suites can be valuable when implemented and configured right — and security teams are trained to make the best use of them. Still, failures and stalled deployments are common. Gartner analyst Oliver Rochford offers these pitfalls and how not to fall into them:
—Failing to plan before buying
Although SIEM solutions share a common capability and feature set, for example they are all competent at log management, third rd party technology support, workflow and deployment architectures do vary widely. As a consequence, buyers often select the “best” solution based on high level criteria such as fancy features, resulting in a mismatch of requirements when it comes to implementation. Instead, CISO should follow a formalized planning approach.
—Failing to define scope
This means identifying the primary objective, Compliance or Threat Management for example, and the resulting security technologies and associated use cases.
—Overly-optimistic scoping.
Many organizations assume that they can monitor their entire environment from day one. In reality, this has to be done in a phased manner, implementing a small amount of technologies and use-cases at a time to allow for the creation of correlation rules, dashboards and reports, as well as performance optimization and troubleshooting.
—Failing to monitor noise
SIEM is not Log Management, where all and sundry logs are collected and stored for compliance and forensics. Instead it relies on correlation rules that depend on specific logs and events to detect threats. Collecting logs indiscriminately impacts performance, adds noise and does not improve detection. Instead we recommend selective forwarding of specific logs as required on a use case by use case basis.
—Lack of sufficient context
By themselves, many event types are difficult to assess and analyze. To provide an example, a user accessing a server may not seem like a risk, but if the user is employed in HR and is accessing a server in research and development, it may indicate malicious activity. This requires organizational context, which should be integrated into the SIEM.
—Inadequate staffing
The last pitfall is sadly the most difficult to solve. Many organizations buy a SIEM without considering the required manpower. The SIEM itself has to be managed and maintained, and the task of monitoring also requires eyes on the logs or regular reviews of reports. While we are aware of some organizations running SIEM with one to two full time employees, to utilize it more broadly we recommend at least four. Round the clock realtime monitoring requires a minimum of 12 people. In cases where that is beyond the available budget, CISO’s should consider a managed security services provider.