Defined Categories of Service 2011 - Cloud Security Alliance

CLOUD SECURITY ALLIANCE SecaaS | DEFINED CATEGORIES OF SERVICE 2011
Category #7: Security Information & Event Management (SIEM)
Description: Security Information and Event Management (SIEM) systems accept (via push or
pull mechanisms) log and event information. This information is then correlated and analyzed
to provide real-time reporting and alerting on incidents / events that may require intervention.
The logs are likely to be kept in a manner that prevents tampering to enable their use as
evidence in any investigations.
Class: Detective
CORE FUNCTIONALITIES
Real time log /event collection, de-duplication,
normalization, aggregation and visualization
Log normalization
Real-time event correlation
Forensics support
Compliance reporting & support
IR support
Email anomaly detection
Reporting
Flexible data retention periods and policies management,
compliance policy management)
OPTIONAL FEATURES
Heuristic controls
Specialized systems
Physical log monitoring
Access control system monitoring
Physical security integration (cameras, alarms, phone, etc.)
Integration with call / ticketing system
CHALLENGES
Standardization of log formats
Timing lag caused by translations from native log formats
Unwillingness of providers to share logs
Scaling for high volumes
Identification and visualization of key information
Usable, segregated by client interface
REFERENCES
http://www.darkreading.com/securitymonitoring/167901086/security/securitymanagement/228000206/cloud-creates-siem-blind-spot.html
http://securecloudreview.com/2010/08/service-provider-oftomorrow-part-9-as-the-cloud-thrives-siem-will-suffer/
Continued on the following page…
SERVICES
Includes: Log management, Event
correlation, Security/Incident response,
Scalability, Log and Event Storage,
Interactive searching and parsing of log
data, Logs immutable (for legal
investigations)
Related Services: Architectural
considerations, Compliance reporting,
Software inventory, Non-traditional
correlation, On-traditional monitoring,
Database monitoring, Request
fulfillment
Related Technologies and Standards:
FIPS 140-2 compliant, Common Event
Format (CEF), Common Event
Expression (CEE), IF-MAP (TCG)
Service Model: SaaS, PaaS
CSA Domains (v2.1): 2, 3, 4, 5, 7, 9, 12
THREATS ADDRESSED
Abuse and Nefarious Use
Insecure Interfaces and APIs
Malicious Insiders
Shared Technology Issues
Data Loss and Leakage
Account or Service Hijacking
Unknown Risk Profile
Fraud
Copyright © 2011 Cloud Security Alliance 20