Vendor Landscape: Security Information & Event Management

Start modestly, but keep the final objective in mind
Don’t try to execute the whole SIEM vision at once. Learn from early stages,
and build capabilities & benefits incrementally.
• Embarking on a SIEM initiative requires a serious investment of time and money. Implementation can be phased in two
distinct, but complementary, ways.
◦ Phased by SIEM function:
– Start with a compliance management focus, but explore the benefits of enhanced event visibility or
– Start with an event management focus, but take advantage of compliance reporting for internal purposes.
– Once both are implemented, look at continuous risk management opportunities – demonstrated benefits from past
experiences might even outweigh the cost of adding 24/7 monitoring.
◦ Phased by source system:
– Start with the most critical systems (key applications, core infrastructure, regulated environments).
– Expand to other log data sources as the benefits of SIEM are demonstrated for those key assets.
• Mix and match these approaches to minimize initial costs, maximize the benefits delivered, and build additional support for
broader SIEM deployments:
◦ Later stages may not deliver the same magnitude of benefits, but they involve lower equipment and configuration costs,
as they leverage initial investments made in earlier stages.
Info-Tech Research Group
59