Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Q&A: Two Trustwave SpiderLabs Experts Describe Their Upcoming SecTor Talk

Two of our SpiderLabs experts - Jeff Pold, director of security information services and Ron Pettit, senior security information specialist - are presenting next week at SecTor, Canada's largest security conference.

Their presentation, titled "SIEM and the Art of Log Management," will not only examine the importance of network monitoring, but also address the challenge of doing it effectively in light of the skills and resource shortages facing many organizations.

We had a chance to sit down with Jeff and Ron before the big conference.

Briefly describe your presentation for us.

During our presentation, we will give a brief overview of what a SIEM is, and how to fully utilize a SIEM within your environment. We'll also describe the benefits and challenges present in either managing a SIEM product yourself or in hiring knowledgeable professionals through a managed security services provider (MSSP).

What do you hope audience members will get out of it?

For attendees who haven't implemented a SIEM in their environment yet, we hope that they will come out of the presentation with a better understanding of what a SIEM can do for them, and what areas they should focus on when deciding which management approach to choose. For attendees already with SIEMs, we have often found that they don't know how to fully utilize their systems, and we hope such attendees will come away with a better understanding of how they can get the most from their SIEM.

OK, let's talk about threat management specifically. Why has it become such a critical obligation for businesses?

Businesses that don't take threat management seriously will eventually end up in the news, and not with positive press. As companies and individual consumers shift more of their resources online, the need for a varied security approach increases, along with the amount of network traffic they see. Attempting to manually monitor all aspects of your network is only getting more complicated, making tools like SIEM necessary to keep track of threats to your network as a whole.

What is most to blame for suspicious or malicious network activity? Advanced threats? Insiders? Increasing mobility?

Honestly, we would say it's a combination on all of the above. Every day new attack vectors are revealed, and with social engineering, less security-savvy employees can become insider threats without even realizing it.

We've written before how network security and threat management can be complex and taxing for resource-stretched organizations. How can companies overcome this?

There really isn't a concept of 'plug-and-play' when it comes to security. Tools such as SIEMs are most effective when partnered with a team knowledgeable enough to utilize them fully. Such well-informed teams can be hard to find, and for those struggling to build such a team, an MSSP can be an excellent alternative.

What size business does a managed (MSSP) model work best for?

The reality is that a managed model is likely to save time and effort for a company of any size, from a couple hundred workstations up to thousands of workstations. It's difficult to find and retain skilled professionals, and expensive to train replacements, regardless of the size of your network. As a result, offloading that headache - and saving money in the process - works for almost any business.

So rather than focusing on the size of your network, look more at how much customization you require to model your network in a SIEM and what capability you have to maintain that configuration. Then, determine whether a managed solution can meet those specific needs.

Anything else you'd like to add?

Most customers fail to realize how powerful a properly configured SIEM can be when fully utilized. Often companies will focus on alerting or meeting compliance requirements, without realizing the SIEM can be used to investigate breaches quickly from a central location. A knowledgeable, dedicated SIEM team, whether that be internal or through an MSSP, can make a world of difference in keeping your network secure.

Jeff and Ron are presenting at 11:30 a.m. ET on Wednesday. For more information about the conference or their talk, visit here.

Latest Trustwave Blogs

Trustwave Webinar: Getting Started with Microsoft Copilot for Security

As a Microsoft security partner, Trustwave has committed itself to helping clients get the most out of their Microsoft E5 license, including properly setting up one of E5's primary features -...

Read More

Think Pink

There are some people who say, "I already conduct red team exercises, why would I need something different that is nothing more than a watered-down red team?"

Read More

Unlock Zero Trust: Why Database Security is the Missing Piece

As organizations consider their journey to establishing a strong Zero Trust culture, they must adopt a data-centric approach, and this begins with ensuring database security.

Read More