Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Q&A: Two Trustwave SpiderLabs Experts Describe Their Upcoming SecTor Talk

Two of our SpiderLabs experts - Jeff Pold, director of security information services and Ron Pettit, senior security information specialist - are presenting next week at SecTor, Canada's largest security conference.

Their presentation, titled "SIEM and the Art of Log Management," will not only examine the importance of network monitoring, but also address the challenge of doing it effectively in light of the skills and resource shortages facing many organizations.

We had a chance to sit down with Jeff and Ron before the big conference.

Briefly describe your presentation for us.

During our presentation, we will give a brief overview of what a SIEM is, and how to fully utilize a SIEM within your environment. We'll also describe the benefits and challenges present in either managing a SIEM product yourself or in hiring knowledgeable professionals through a managed security services provider (MSSP).

What do you hope audience members will get out of it?

For attendees who haven't implemented a SIEM in their environment yet, we hope that they will come out of the presentation with a better understanding of what a SIEM can do for them, and what areas they should focus on when deciding which management approach to choose. For attendees already with SIEMs, we have often found that they don't know how to fully utilize their systems, and we hope such attendees will come away with a better understanding of how they can get the most from their SIEM.

OK, let's talk about threat management specifically. Why has it become such a critical obligation for businesses?

Businesses that don't take threat management seriously will eventually end up in the news, and not with positive press. As companies and individual consumers shift more of their resources online, the need for a varied security approach increases, along with the amount of network traffic they see. Attempting to manually monitor all aspects of your network is only getting more complicated, making tools like SIEM necessary to keep track of threats to your network as a whole.

What is most to blame for suspicious or malicious network activity? Advanced threats? Insiders? Increasing mobility?

Honestly, we would say it's a combination on all of the above. Every day new attack vectors are revealed, and with social engineering, less security-savvy employees can become insider threats without even realizing it.

We've written before how network security and threat management can be complex and taxing for resource-stretched organizations. How can companies overcome this?

There really isn't a concept of 'plug-and-play' when it comes to security. Tools such as SIEMs are most effective when partnered with a team knowledgeable enough to utilize them fully. Such well-informed teams can be hard to find, and for those struggling to build such a team, an MSSP can be an excellent alternative.

What size business does a managed (MSSP) model work best for?

The reality is that a managed model is likely to save time and effort for a company of any size, from a couple hundred workstations up to thousands of workstations. It's difficult to find and retain skilled professionals, and expensive to train replacements, regardless of the size of your network. As a result, offloading that headache - and saving money in the process - works for almost any business.

So rather than focusing on the size of your network, look more at how much customization you require to model your network in a SIEM and what capability you have to maintain that configuration. Then, determine whether a managed solution can meet those specific needs.

Anything else you'd like to add?

Most customers fail to realize how powerful a properly configured SIEM can be when fully utilized. Often companies will focus on alerting or meeting compliance requirements, without realizing the SIEM can be used to investigate breaches quickly from a central location. A knowledgeable, dedicated SIEM team, whether that be internal or through an MSSP, can make a world of difference in keeping your network secure.

Jeff and Ron are presenting at 11:30 a.m. ET on Wednesday. For more information about the conference or their talk, visit here.

Latest Trustwave Blogs

Mining Operations: Critical Cybersecurity Threats & Trends Revealed

Cybersecurity professionals often point out that threat actors do not differentiate when choosing a victim. To an attacker, a hospital is as useful a target as a law firm or even a mining operation....

Read More

Phishing: The Grade A Threat to the Education Sector

Phishing is the most common method for an attacker to gain an initial foothold in an educational organization, according to the just released Trustwave SpiderLabs report 2024 Education Threat...

Read More

Unlocking Cyber Resilience: UK’s NCSC Drafts Code of Practice to Elevate Cybersecurity Governance in UK Businesses

In late January, the UK’s National Cyber Security Centre (NCSC) issued the draft of its Code of Practice on Cybersecurity Governance. The document's goal is to raise the profile of cyber issues with...

Read More