Two of our SpiderLabs experts - Jeff Pold, director of security information services and Ron Pettit, senior security information specialist - are presenting next week at SecTor, Canada's largest security conference.
Their presentation, titled "SIEM and the Art of Log Management," will not only examine the importance of network monitoring, but also address the challenge of doing it effectively in light of the skills and resource shortages facing many organizations.
We had a chance to sit down with Jeff and Ron before the big conference.
Briefly describe your presentation for us.
During our presentation, we will give a brief overview of what a SIEM is, and how to fully utilize a SIEM within your environment. We'll also describe the benefits and challenges present in either managing a SIEM product yourself or in hiring knowledgeable professionals through a managed security services provider (MSSP).
What do you hope audience members will get out of it?
For attendees who haven't implemented a SIEM in their environment yet, we hope that they will come out of the presentation with a better understanding of what a SIEM can do for them, and what areas they should focus on when deciding which management approach to choose. For attendees already with SIEMs, we have often found that they don't know how to fully utilize their systems, and we hope such attendees will come away with a better understanding of how they can get the most from their SIEM.
OK, let's talk about threat management specifically. Why has it become such a critical obligation for businesses?
Businesses that don't take threat management seriously will eventually end up in the news, and not with positive press. As companies and individual consumers shift more of their resources online, the need for a varied security approach increases, along with the amount of network traffic they see. Attempting to manually monitor all aspects of your network is only getting more complicated, making tools like SIEM necessary to keep track of threats to your network as a whole.
What is most to blame for suspicious or malicious network activity? Advanced threats? Insiders? Increasing mobility?
Honestly, we would say it's a combination on all of the above. Every day new attack vectors are revealed, and with social engineering, less security-savvy employees can become insider threats without even realizing it.
We've written before how network security and threat management can be complex and taxing for resource-stretched organizations. How can companies overcome this?
There really isn't a concept of 'plug-and-play' when it comes to security. Tools such as SIEMs are most effective when partnered with a team knowledgeable enough to utilize them fully. Such well-informed teams can be hard to find, and for those struggling to build such a team, an MSSP can be an excellent alternative.
What size business does a managed (MSSP) model work best for?
The reality is that a managed model is likely to save time and effort for a company of any size, from a couple hundred workstations up to thousands of workstations. It's difficult to find and retain skilled professionals, and expensive to train replacements, regardless of the size of your network. As a result, offloading that headache - and saving money in the process - works for almost any business.
So rather than focusing on the size of your network, look more at how much customization you require to model your network in a SIEM and what capability you have to maintain that configuration. Then, determine whether a managed solution can meet those specific needs.
Anything else you'd like to add?
Most customers fail to realize how powerful a properly configured SIEM can be when fully utilized. Often companies will focus on alerting or meeting compliance requirements, without realizing the SIEM can be used to investigate breaches quickly from a central location. A knowledgeable, dedicated SIEM team, whether that be internal or through an MSSP, can make a world of difference in keeping your network secure.
Jeff and Ron are presenting at 11:30 a.m. ET on Wednesday. For more information about the conference or their talk, visit here.