UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
Making Log Data Useful: SIEM and Log Management Together by Dr. Anton Chuvakin
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
Notes de l'éditeur
Organizations that graduate too soon will waste time and effort, and won't any increased efficiency in their security operation. However, waiting too long also means that the organization will never develop the necessary capabilities to secure themselves. In brief, the criteria are:Response capability: the organization must be ready to respond to alerts soon after they are produced.Monitoring capability: the organization must have or start to build security monitoring capability such as a Security Operation Center (SOC) or at least a team dedicated to ongoing periodic monitoring.Tuning and customization ability: the organization must accept the responsibility for tuning and customizing the deployed SIEM tool. Out-of-the-box SIEM deployments rarely succeed, or manage to reach their full potential.
“Graduating” from LM to SIEMWho should do it? Orgs that are ready for monitoring and responseHow to go about it? Use a vendor that does bothWhen? Deploy LM first and use it. Be ready to monitor [reactive -> faster/better reactive]What to look for? Integrated LM and SIEM
Deploy – use - operationalize – get comfortable with!
LM before SIEM!Plan, deploy and operationalize LM (forget SIEM for now)Use LM regularly before evolvingSolve problems – and discover new problems (that call for SIEM maybe)
Happy with LM? Then go -> SIEMPhased deployment!Filter some logs into SIEMHow to decide? Correlation, use cases, stakeholders, etcPrepare to build use cases slowlyThings to watch for while evolvingInitially increased workload: now you do more useful stuff!
SIEM first stepsSimple use cases that are your own: based on key risks to your business, key issues you’d like to monitor forSecurity monitoring for complianceTraditional use (if customer does not have preferred use cases and does not know how to find them)IDS/IPS and firewall analysisLogin trackingWeb application hacking
Using SIEM with LM: integrated use caseIncident response use case: alert -> log investigationMini-SOC monitoring and analysis
SIEM use casesSOC – full real-time monitoringMini-SOC / ”morning after”Remote monitoring + investigationsCompliance status reporting