Jim Hansen, VP of Products, Security and Cloud Management at SolarWinds, says SIEM Software can go a long way toward managing and understanding the cyberthreat landscape.
While there is no one single solution to guard agencies against all cyberthreats, there are tools that can certainly go a long way toward managing and understanding the cyberthreat landscape. One such tool is Security Information and Event Management (SIEM) software. SIEM tools combine Security Information Management (SIM) with Security Event Management (SEM) capabilities into a single solution with the intent of delivering comprehensive threat detection, incident response, and compliance reporting capabilities.
SIEM tools work by collecting information from event logs from most (if not all) agency devices, from servers and firewalls to antimalware and spam filters. The software then analyzes these logs, identifies anomalous activity, and issues an alert—or, in many cases, responds automatically.
While log data comes from many locations, SIEM software consolidates and analyzes this data as a whole; the federal IT pro can then view all the data from a single dashboard. A single, unified view can help identify trends, easily spot unusual activity, and help establish a proactive (vs. reactive) response.
Choosing a SIEM Tool
There are a wide variety of SIEM tools available today, each offering its own advantages. SIEM tools can offer everything from big data analytics to centralized forensic visibility to artificial intelligence-driven behavior analytics. It can be a challenge to choose the tool that fits agency requirements.
- Does the SIEM provide enough native support for all relevant log sources? Be sure the chosen toolset matches well with the types of devices from which it will be collecting and analyzing information.
- If the SIEM doesn’t have native support for a relevant log source, how quickly and easily can it be created, and can it support custom log sources for applications the agency has developed in-house?
- Reducing the time to detection (TTD) is critical to prevent exposure, data loss, and compromise. Choose a SIEM tool with the ability to provide advanced analysis quickly, with little security team intervention.
- Does the SIEM include useful, relevant, and easy-to-use out-of-the-box reports? The value in a single-pane-of-glass approach provided through SIEM software is the ability to see one report or one chart that encompasses a vast amount of data. Be sure the agency’s chosen tool provides templates that can be easily implemented and just as easily customized where necessary.
- Does the SIEM make it easy to explore the log data and generate custom reports? Choose a tool that simplifies the data exploration and reporting function to help you get answers quickly and with minimal effort.
Conclusion
The bad guys continue to get smarter, are well funded, and know most federal agencies aren’t funded well enough to thwart their continuously changing tactics. As the world becomes more interconnected and complex, and as cloud and Internet of Things (IoT) devices become part of the federal landscape, federal agencies need to be thoughtful and smart about how they combat the threats actively targeting them.
A SIEM tool can dramatically ease the burden of every federal IT pro, saving valuable time and providing an additional security checkpoint across the agency’s systems.