Vendor Landscape: Security Information & Event Management

Understand the ongoing staffing impacts, both positive and
negative
Examine compliance and incident management savings against increased
monitoring costs.
• For incident response staff and supporting system administrators, SIEM is a
double-edged sword:
◦ Increased incident response efficiencies are countered by increased
event visibility, until and unless SIEM-driven improvements are made to
key security and system controls.
◦ In the short term, this typically means a greater burden on security staff.
• Organizations facing regular and/or diverse regulatory requirements can
reduce their associated reporting burdens substantially:
◦ In many cases, required reports can be generated automatically and
consistently across multiple systems, without burdening the system
admins.
◦ Many SIEM solutions offer reports on internal SIEM activity. Such reports
can be used to demonstrate compliance with various regulatory log
review requirements.
– If this capability is needed, make sure to configure your SIEM system
to send links to the reports that will be viewed by system
administrators, as opposed to sending the entire report.
– This forces sysadmins to log into the SIEM solution directly to access
reports, which in turn generates the audit record necessary for
demonstrating that the logs have been reviewed.
Info-Tech Research Group
56