Vendor Landscape: Security Information & Event Management

Determine how you intend to staff SIEM monitoring and
alerting functions
"Once there is seeing, there must be acting. Otherwise, what is the use of
seeing?” (Thich Nhat Hanh, Vietnamese Zen Buddhist Monk)
• Real-time event monitoring can be a huge cost driver for
SIEM:
◦ For organizations lacking a dedicated Security
Operations Center (SOC), adding a dedicated 24/7
monitoring capability could equate to an increase of 5
Full Time Equivalents.
◦ Consider adding a “best effort” event monitoring
responsibility to existing security staff – a 10-20% rise in
staffing levels could enable much better incident
response outcomes.
• Alternatively, consider a Managed Security Service
Provider (MSSP) approach to staffing your SIEM solution:
◦ MSSPs can provide 24/7/365 monitoring and alerting at
a fraction of the cost of providing the service yourself.
◦ Many MSSPs also provide incident response services
that can supplement on-staff personnel during off hours.
◦ The trade-off: your SIEM data is either stored off-site
(with associated bandwidth impacts), or accessible to
3 rd parties, or both. Be sure to address these security
and confidentiality issues in your MSSP contract.
Info-Tech Insight
SIEM monitoring through an MSSP can
provide cost-effective alternatives for
real-time event monitoring:
• MicroAge, an IT services firm, opted
for an MSSP to provide on-premise
SIEM equipment and remote
monitoring services.
• For a monthly fee, MicroAge avoided
the capital cost of a SIEM solution
supporting 120 log sources.
• In the same monthly fee, MicroAge
receives 24/7 real-time event
monitoring, with serious events
escalated to internal IT staff, at a
small fraction of the cost of staffing
such a capability internally.
You get an alarm system for your
network, but you don't get the cops to
go with it.
- Perry Kuhnen, IT Manager, MicroAge
(about SIEM without real-time monitoring)
Info-Tech Research Group
57