What Is Security Information and Event Management (Siem)?

In the myriad of IT systems designed to protect an enterprise’s sensitive data, it’s the Security Information and Event Management (SIEM) software that assembles all the security logs and event data into a central location for meaningful analysis of past breach events, detection of security weaknesses, and validation of audit records for compliance regulations. SIEM software built on strong data management procedures is becoming to enterprise security professionals what Houston is to the astronauts.

SIEM (pronounced “sim”) software has been around for over a decade and in its most basic form is designed to do four things:

• Accept relevant data from multiple sources
• Normalize and analyze the data
• Identify potential security issues
• Take action by generating alerts or instructing other security controls to shut down the offending activity

These are not small tasks and an organization’s SIEM system is only as good as the data on which it’s built.

Making Sense of Log Data

Today’s data security ecosystems span across host systems, network devices, servers, domain controllers, firewalls, antivirus filters, intrusion prevention systems, and so on. Each of these networked components generates their own log and event data which are text-based files that are produced automatically every time certain events occur in the system. Log files are usually time-stamped and may record practically anything that is happening behind the scenes in operating systems or software applications, including when users log in or attempt to log in.

Not only are numerous log files created any time an activity happens, to complicate things a bit more, not all log data is created the same — literally. There are audit logs, transaction logs, event logs, error logs, and message logs that all serve different purposes and can come in a variety of extensions like .log .txt or even proprietary extensions. Some logs can be read by using a standard text editor while others require particular applications to view and extract useful data from them. Some logs can be read by a human while others that are kept for auditing purposes that are not even human-readable.

Over time, the number of logs grows exponentially, especially in larger enterprises that can generate hundreds of gigabytes of log data per day. This immense amount of disparate data creates the need for a systematic approach to maintaining security logs. Log management is the discipline of developing processes to collect, centralize, parse, transmit, store, archive, and dispose of massive amounts of computer-generated log data, especially for the purposes of security, performance enhancements, auditing, or troubleshooting. A good log management system is key to getting the information aggregated and unified in one location, but it is still only one piece of a holistic system that utilizes the information in these logs for real-time security monitoring.

Why SIEM is Important

The management of all this data is an expensive, time, and resource-consuming process that requires a lot of customization and planning. However, the value of these logs is not in the logging itself. It’s in the analysis of the logs to address three important aspects of a comprehensive security strategy.

Incident Detection

A well-run SIEM system can detect security incidents that would go unnoticed without it by logging security events, analyzing the log entries for signs of attack or malicious activity from sources across the network. A SEIM can use this data to reconstruct the events and determine the nature of the attack and if it did or did not succeed.

Regulatory Compliance

Regulated industries rely heavily on SIEM because failing a compliance audit could mean loss of business, damage to reputation, and hefty fines. SIEM is a method for companies to protect their most sensitive data and establish proof they are doing so, which allows requirements to be met.

Incident Management

SIEM solutions can significantly increase the efficiency of incident handling with the real-time monitoring and customized alerts and protocols security teams establish. This ultimately increases the speed of incident containment, which can reduce the extent of damage a breach can cause.