Vendor Landscape: Security Information & Event Management

Executive Summary
Understand SIEM Trends and Considerations
• Security Information & Event Management (alternatively known as Security Incident & Event Management) technologies
have evolved from point solutions into comprehensive systems that allow organizations to optimize any or all of the
following important security-related functions:
◦ Collection and management of critical system and network log data.
◦ Execution of processes in support of regulatory and policy compliance obligations.
◦ Identification of information security threats and responses to them.
◦ Continuous information security risk management processes.
• Understand your organization’s needs, potential costs, and readiness to undertake a SIEM deployment before taking the
leap.
Evaluate SIEM Vendors
• Vendor offerings target these security functions in substantially different ways based on their SIEM product origins,
integration with their broader security offerings, architectural deployment options, and specific market focus.
• Map your organization’s immediate and future requirements for SIEM against vendor and product capabilities, and
leverage the tools and templates included in this solution set to accelerate selection of a SIEM technology.
Develop a SIEM Implementation Strategy
• Understand options for managed versus self-staffed SIEM implementations and their pros and cons.
• Design a deployment architecture and capture additional implementation and operational costs and benefits, based on
addressing your organization’s specific security and compliance requirements.
• Develop a plan for a phased implementation of the selected SIEM product and architecture, ensuring that you realize both
short and long-term objectives and benefits.
Info-Tech Research Group
3