How Do Security Intelligence Solutions Differ from First-Gen SIEM Products?

This is part 2 of an ongoing series of posts that answer “Six Things You Always Wanted to Know About Security Intelligence but Were Afraid to Ask.”

Now that we have a good understanding of Security Intelligence, let’s draw a clear picture of how modern Security Intelligence solutions evolved – and differ – from first-generation SIEM products.  SIEM has become a widely deployed technology over the last 5+ years, and for good reason.  But due to scale limitations and lack of visibility, legacy SIEM products can no longer go toe-to-toe with the advanced targeted threats (AKA, advanced persistent threats) making headlines today.

Log Management and Security Information and Event Management (SIEM) products are a standard element of the IT security landscape today.  Large and small organizations in private and public sectors have widely adopted the solutions, and Gartner has published its SIEM Magic Quadrant report for a number of years.  (Reportedly it’s one of Gartner’s most popular MQ reports across all IT disciplines.)  The popularity of SIEM owes to its value:  sophisticated monitoring and reporting on diverse network activity, enabling the identification of potential security risks and ensuring compliance with regulatory and policy requirements.

But first-generation SIEM products are now obsolete. Yes, obsolete. Here’s where they lag Security Intelligence solutions:

  • No network activity monitoring. In the past, event logs from devices, applications and servers gave you a rough idea of what was happening on your network.  Today, that’s just a starting point.  Security Intelligence now requires real-time visibility into the flows, user activity, social media usage, mobile access and application content traversing your network – something first-gen SIEM can’t offer.  Is that conversation using port 80 really web traffic, or is it a hidden botnet IRC communication?  Have intruders compromised a user account and used it to post sensitive information to social media sites?  Are your employees committing fraud or transmitting sensitive intellectual property inappropriately?  Without integrating network behavior analysis / anomaly detection into SIEM, you won’t know until it’s too late.
  • Not architected to scale. First-gen SIEM products did a passable job of collecting and correlating event logs for moderate size organizations.  But add in flow data, perform a few simultaneous searches, or deploy in a very large enterprise, and first-gen SIEM’s choke.  The reason is simple: they’re not architected to scale.  They depend on external relational databases, which struggle to support the volume of I/O operations involved in demanding scenarios.  Security Intelligence solutions are built from the ground up with purpose-built databases, so they can collect and correlate massive volumes of data in real time, and still respond nimbly to ad hoc searches.
  • No pre-exploit security awareness. The Security Intelligence timeline doesn’t begin at the point of exploit or breach.  That’s just when the clock starts ticking on your detection and remediation activities.  Modern Security Intelligence solutions inherently differ from first-generation SIEM products by integrating pre-exploit risk and vulnerability management capabilities, as one example.  This allows you to identify, prioritize and reduce risks associated with misconfigured devices and unpatched vulnerabilities.  In this way you actually reduce the number of breaches, as well as detect and remediate the ones that occur.
  • Reliance on signature-based detection. The game has changed.  You can’t sit back, update your malware signatures, and expect to protect your network.  First-gen SIEM offerings relied too much on the assumption of a finite and familiar set of threats.  This approach fails when the threat vectors grow exponentially more diverse by the day.
  • Too slow to deploy, too expensive to staff. When first-gen SIEMs hit the market, early adopters were willing to spend plenty of time and money to get them up and running.  Connectors and rules needed to be written, users needed to be trained and so on.  Once in production, their staffing requirements could also be significant.  They spit out too many false positives, thus requiring the addition of staff to investigate volumes of incidents.  Modern Security Intelligence solutions use a broader set of data (event, flow, asset, topology, vulnerability, configuration, etc.) and advanced automation to cut through the noise and reduce – not expand – security staffing requirements.  One organization, for example, reduced ongoing security staff time requirements by 88% with Security Intelligence:

In sum, Security Intelligence solutions have made first-generation SIEM point products obsolete, and now help organizations protect against more challenging and diverse threats, with far less effort.  They expand the scope of analysis to identify and prioritize risks before the point of exploit, and detect and resolve breaches faster through user activity and content visibility.  They also scale to far greater volumes of data at radically reduced storage costs.  And they are deployable and manageable with less manual work, satisfying stringent budget and ROI parameters.

Or in the words of one of our other customers, a leading provider of photonics-based solutions:

“We recently had an incident where someone was trying to port scan one of our email servers. Our previous system would not have seen this intrusion. Because of QRadar, we quickly – in a matter of minutes – located the individual computer and shut down the activity before any further damage could be done. The ability to locate and analyze information quickly – almost instantaneously – and in a fashion we could not do before has saved us incredible amounts of time.”

Stay tuned for the next post in this series, where we’ll look in depth at the question of how much staffing and expertise is needed to use Security Intelligence solutions

More from Risk Management

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging. We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically. For this reason, 75% of organizations…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…