Security Monitoring and Analytics: Moving Beyond the SIEM

This is the final installment in a three-part series. Be sure to read Part 1 and Part 2 for more information.

Improving integration, visibility and analytics with a platform approach to security information and event management (SIEM) is the means to the business value of security, compliance and operational efficiency.

Security teams are operating in an evolving macro environment, which presents three challenges:

  1. The incredible rate of change in information technology infrastructure has led to such complexity in our networks, systems and applications that most organizations struggle with the in-house capabilities and resources to keep up.
  2. Regulatory and legal responses to these issues can literally be years behind, and yet the intensifying requirements for demonstrating compliance represent another significant demand on limited in-house resources.
  3. At the same time, the attackers are increasingly sophisticated, focused and disruptive.

These forces — in combination with a critical skills shortage in cybersecurity — are driving a significant shift in how enterprise security operations centers (SOCs) are evolving.

Download the Report: The Business Value of a Security Analytics Platform

Four Capabilities to Build a More Efficient Security Operations Center

To keep up with the complexity and compliance of their computing infrastructures — and to get ahead of the current time advantage of the attackers — enterprise SOCs need to build on the foundation of their existing SIEM platforms with additional capabilities such as:

  • Advanced threat monitoring that leverages the rules engines of the leading SIEM platforms, in combination with the specialized expertise and focus of full-time threat hunters, to make continuous improvements in use cases;
  • Advanced threat detection that combines context-specific data with analytics and machine learning to look for suspicious patterns, behaviors and anomalies across a wider range of both historical and real-time data;
  • Accelerated incident investigation of suspected incidents with increasingly automated triage, prioritization and validation of alerts based on context-specific data — in addition to a final review and validation by human security analysts; and
  • Faster incident response by replacing purely ad hoc activities with common playbooks, analytical tools, incident management tools and reporting, which liberates security analysts to spend less time doing research and more time doing analysis.

Ultimately, these capabilities help to deliver value by reducing the total time needed to detect, investigate, respond and remediate security-related incidents — from the status quo of weeks and months to as short as hours and days.

Taking SIEM to the Next Level

Many organizations lack the resources — both bandwidth of existing personnel and specialized technical expertise — and the tactical focus to perform well at these types of activities. Their primary strategic focus is on running and growing their business, not security, compliance, privacy and risk.

Even if a given organization is capable of traditional, do-it-yourself integration of on-premises security solutions using in-house resources, is it really better off doing these activities on its own? A growing number of companies choose to leverage the expertise, scale and scope of a specialized, third-party security services provider and prioritize other activities for their own staff. Regardless of how you implement — whether in-house, software-as-a-service (SaaS) or fully outsourced — what’s important is that you address these needs by taking your SIEM platform to the next level.

Either way, the platform approach to security monitoring and analytics is well-aligned with these capabilities, while a traditional, tools-based approach is not.

Download the Report: The Business Value of a Security Analytics Platform

Share this Article:
Derek Brink

VP & Research Fellow, IT Security and IT GRC, Aberdeen Group

Derek Brink helps individuals to improve their critical thinking, commuication skills and leadership skills by teaching graduate courses in information security and IT management at Brandeis University. He also helps organizations to improve their security and compliance initiatives by researching, writing about and speaking about the people, processes and technologies that correspond most strongly with leading performance, as part of his role as vice president and research fellow at Aberdeen Group, A Harte Hanks Company. Derek Brink helps individuals to improve their critical thinking, commuication skills and leadership skills by teaching graduate courses in information security and IT management at Brandeis University. He also helps organizations to improve their security and compliance initiatives by researching, writing about and speaking about the people, processes and technologies that correspond most strongly with leading performance, as part of his role as vice president and research fellow at Aberdeen Group, A Harte Hanks Company. He is experienced in high-tech strategy development and execution, corporate / business development, product management and product marketing, through positions at RSA Security, IBM, Sun Microsystems, and Hewlett-Packard. Derek earned an MBA with honors from the Harvard Business School and a BS in Applied Mathematics with highest honors from the Rochester Institute of Technology.