SIEM (Security Information and Event Management) and AI-Based Security Analytics is something of a match made in heaven and used to best effect in the Security Operations Center (SOC). Or, maybe more realistically, it’s a match made in the Cloud, which is kind of the same thing. That natural fit is why Gurucul’s Security Analytics platform was architected to integrate seamlessly with pretty much any legacy SIEM out there. It’s such a good fit, in fact, that a lot of dedicated SIEM vendors have started to incorporate their own analytics component. Which seems fair, since Gurucul is perfectly capable of operating as a SIEM in its own right. Though, to be fair, it’s really more than just a SIEM with cyber security analytics. Here are SIEM Best Practices to follow to get the most benefit from a modern analytics-driven SIEM.
Getting the Most Out of The SIEM + Security Analytics Platform
Getting the best performance and most benefit out of any cyber-security system requires following the industry Best Practices. The challenge can sometimes be figuring out how to adapt best practices to your own organization’s specific environment. Our world of SIEM and Behavior Analytics is no exception. There are general SIEM best practices here too. Though, like with everything else in your security stack, you’ll need to adapt the details to fit your situation.
The question, of course, is what are the SIEM best practices? Well, to address that we have a webinar coming up where we’ll go into it. In the meantime, I’ll sum up the talk for you here.
Best Practices are Best
Most of the Best Practices papers you’ll see on the subject are focused on the Implementation phase. While that makes sense, it’s not what we’re covering. Except for the lead piece of advice about where to deploy your SIEM and Analytics platform. And for that, we point to the Cloud. While your organization may require on-premises installation due to regulations, or your IT department favors Hybrid deployments, the reality is that a Cloud deployment is often the way to go.
The fact that our security platforms are designed to run Cloud-Native, backed by so much of our infrastructure being in the cloud, makes it a natural fit. Add the scalability, versatility, flexibility, and easy maintenance, and it’s an obvious choice. Your own situation may dictate a Hybrid or On-Prem solution, but from a SIEM Best Practices perspective, it’s cloud for the win.
Integrate and Orchestrate
A core strength of any SIEM platform is the ability to display telemetry from pretty much any system in your environment. And that includes systems outside the security stack. That integration also comes into play when you’re leveraging Security Analytics. The more information the analytics engine can chew on, the better results it can deliver. Having different kinds of data gives it more context and lets it correlate a broader range of events. So, integration for the win. It’s one of the more critical SIEM Best Practices.
As for orchestration, the improved contextual information lets the SecOps team work more effectively. They can see individual risks, rather than just a series of unrelated events. It also improves automation, orchestration, and response. SIEM Best Practices are to integrate all of your telemetry into the platform, enable analytics, and let it handle orchestration tasks. By integrating everything, it can respond to everything quickly and effectively.
Mitigate and Investigate
One of the advantages of integrating Analytics and SIEM is their combined ability to assist in the Mitigation and Remediation phases after they’ve identified an attack. Even when an attack is stopped early in the cycle before it could do any damage, there is still some cleanup. You need to find the root cause of the breach, figure out what paths the attacker took, and identify any other potentially compromised systems in the environment. With that you can draw out anything they may have left behind and close the gaps they slipped through in the first place.
In cases where the information security team needs to do an investigation beyond the normal remediation and mitigation steps, an integrated Analytics and SIEM platform gives them the information they need. It can provide them both correlation and context to get the bottom of an incident, which is another of our SIEM Best Practices.
User Authorization and Monitoring
Behavior Analytics is a core function of our integrated platform, which makes its use for monitoring user behavior and enabling Risk Based Authentication a natural fit. Here, the Best Practice is to enable both capabilities.
Analytics makes Risk Based authentication possible. By looking at everything as a whole, including user behavior both in isolation and compared to their peers, and the resources they interact with, it’s possible to adjust authorization requirements to suit the real-world situation. When the risks are low, you can adjust authentication requirements to favor user convenience. When the risks are higher, you can require higher levels of authentication security. It’ll be more intrusive to the user, but only when the situation justifies it.
Likewise, with user monitoring. Behavior analytics can correlate user behaviors to identify risk, even when the risk might be something the user’s not even aware of.
But Wait. There’s more!
There is more to the SIEM Best Practices list, such as integrating a security framework like MITRE ATT&CK, tying in real-time reactions, and leveraging SIEM and Analytics to deliver improved reporting and meet compliance requirements. What’s best for your organization depends on your specific environment and operational needs. But there is no doubt that combining these capabilities will improve the situation.
Now, this is where I put in a shameless plug for the webinar and say if you want to know more, come and join us for the presentation.