Vendor Landscape: Security Information & Event Management

More documents

Recommendations

Info

Understand what SIEM does, and what it doesn’t do SIEM technology is not a panacea, but adds value by extending visibility across existing information security and system management tools. SIEM Tools DO: At a minimum, SIEM tools enable IT security organizations to: • Leverage central log management to simplify correlation, alerting, and reporting of security events; • Streamline compliance, incident response, and risk management processes; • Baseline threat levels and normal network security activity; • Increase efficiency and effectiveness of security and system administrators, internal and external auditors, and senior management involved in risk management; • Pursue a continuous risk management strategy, prioritizing attention to specific vulnerabilities based on observed threats across multiple control systems. SIEM Tools DO NOT: Contrary to past hype and misconceptions, SIEM tools do not: • Eliminate the need for other IT security systems – rather, SIEM enhances the value of each of those tools; • Directly prevent compromises – instead, SIEM provides the cross-system visibility to identify areas of elevated risk and focus security efforts (proactive), and reduces the cost and time for incident response (reactive); • Eliminate the role of security administrators and operations personnel – SIEM maximizes the value of such staff. Info-Tech Research Group 6
Like every tool, SIEM has limitations; expect too much you will be disappointed Focus your SIEM implementation where it is most urgently needed, and be realistic about its overall benefits – and costs. • When clients using SIEM solutions were asked about their expectations for the solution, they almost universally indicated that they had very high expectations prior to deployment. • Those same clients indicated that their SIEM solution failed to meet expectations in almost every measure. • Failure to meet expectations should not be held against the tools since in almost every measurable category, the tools delivered Moderately Significant to Significant positive Impact to the enterprise. • The moral: oversetting expectations can lead to let-down even with deployments that are successful and improve enterprise security, compliance, and overall risk management. N=34 Info-Tech Research Group 7
Page 1 and 2: Vendor Landscape: Security Informat
Page 3 and 4: Executive Summary Understand SIEM T
Page 5: Understand SIEM Trends and Consider
Page 9 and 10: Determine how and where SIEM will h
Page 11 and 12: Be clear about the impact of SIEM-e
Page 13 and 14: Evaluate SIEM Vendors What’s in t
Page 15 and 16: SIEM Vendor selection / knock-out c
Page 17 and 18: The Info-Tech SIEM Vendor Landscape
Page 19 and 20: The Info-Tech SIEM Value Index What
Page 21 and 22: Advanced Features are the capabilit
Page 23 and 24: LogRhythm’s comprehensive SIEM fe
Page 25 and 26: Sensage is a small company that eas
Page 27 and 28: Q1 Labs QRadar: a quality product l
Page 29 and 30: LogLogic provides a strong solution
Page 31 and 32: NitroSecurity continues to bring a
Page 33 and 34: SolarWinds is a newer face in the m
Page 35 and 36: RSA has a solid solution, but also
Page 37 and 38: Symantec offers vendor stability an
Page 39 and 40: ArcSight offers both enterprise- an
Page 41 and 42: Trustwave’s strength is in their
Page 43 and 44: Streamline monitoring, alerting, an
Page 45 and 46: Ensure the reduction of enterprise
Page 47 and 48: Issue an RFP to ensure SIEM vendors
Page 49 and 50: Take charge of vendor demonstration
Page 51 and 52: Getting to a SIEM implementation st
Page 53 and 54: Identify constraints for your SIEM
Page 55 and 56: Account for implementation resource
Page 57 and 58:
Determine how you intend to staff S
Page 59 and 60:
Start modestly, but keep the final
Page 61 and 62:
Vendor Landscape Methodology: Overv
Page 63 and 64:
Vendor Landscape Methodology: Scori
Page 65 and 66:
Vendor Landscape Methodology: Infor
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Vendor Landscape Methodology: Fact
Page 73 and 74:
Product Pricing Scenario, continued
Page 75 and 76:
Country Info-Tech Research Group 75
Page 77 and 78:
FTEs Info-Tech Research Group 77
show all

Vendor Landscape: Security Information & Event Management

Create successful ePaper yourself

Delete template?

Save as template?