Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideFindings from the Project Survey revealed that organisations face significant challenges in acquiring cyber security logmanagement tools and services, nearly all respondents found it difficult or very difficult to:1. Find effective cyber security monitoring and logging products at a reasonable price2. Obtain relevant log details from service providers (eg. because it is not in the contract)3. Configure their cyber security appliances or tools effectively4. Create meaningful and helpful requests for proposals (RFP), rather than just re-using standard format5. Deal with the proliferation of ‘specialist’ (often proprietary) tools and their lack of integration6. Use a SIEM tool for cyber security purposes7. Determine which cyber security appliances, tools or services they need8. Purchase cyber security appliances or tools for cyber security purposes, rather than to just meet compliancerequirements9. Clarify the specific functionality and purpose of products and services that vendors are actually selling.“It’s tough to do cyber security monitoring and logging well – and expensive. It is often easy fororganisations to do something (like buy an IDS or SIEM product), but tough to make it effective”Analysis of external log management toolsWorkshop participants identified and evaluated a range of commercial and open source tools that can be used to supportcyber security logging in two main different categories, being log management/analysis and SIEM. They evaluated thesetools in terms of their usefulness, value for money and complexity.The results of this analysis indicate that:• Many log management/analysis tools, be they commercial or open source, can be very useful at a reasonable cost,but are often complex• Most leading SIEM tools are very useful (although sometimes not as useful as vendors claim), but are typically bothexpensive and complex to implement properly.Organisations could make better use of free open source tools (there are many), andhome grown scripts.Workshop participants highlighted that there are a wide range of issues to consider when selecting an appropriate set oflog management tools, which go beyond the topics highlighted above and often include the need to consider:• Implementation and preliminary work required for each tool• The volume of data, how it is stored and retention requirements• Log data jurisdiction and compliance requirements• Data retention requirements• Searching and querying data• Data segregation.It can be useful to do a SWOT analysis to look at the security monitoring tools andboxes you need, considering a range of topics, such as :• Your objective for log management, as well as the criticality of the data andservices concerned• Whether the device or tool is in-line (such as a firewall) or sits to the side• Commercial, open source or home grown solutions24