In an increasingly complex environment, cybersecurity can seem like a frustrating enigma. It remains one of the most important priorities for federal IT pros—and one of the most challenging.
While there is no one single solution to guard agencies against all cyberthreats, there are tools that can certainly go a long way toward managing and understanding the cyberthreat landscape. One such tool is Security Information and Event Management (SIEM) software. SIEM tools combine Security Information Management (SIM) with Security Event Management (SEM) capabilities into a single solution with the intent of delivering comprehensive threat detection, incident response, and compliance reporting capabilities.
SIEM tools work by collecting information from event logs from a majority of (if not all) agency devices, from servers and firewalls to antimalware and spam filters. The software then analyzes these logs, identifies anomalous activity, and issues an alert—or, in many cases, responds automatically.
Specifically, with SIEM software a federal IT pro can quickly identify potentially suspicious activity, learn who has been affected, and implement automated mechanisms to stop an attack before it impacts the agency.
One of the primary advantages of SIEM software is the combination of consolidation and centralization. While data is coming from many locations, SIEM software consolidates and analyzes this data as a whole; the federal IT pro can then view all the data from a single dashboard. A single, unified view can help identify trends, easily spot unusual activity, and help establish a proactive (vs. reactive) response.
Choosing a SIEM Tool
There are a wide variety of SIEM tools available today, each offering its own advantages. SIEM tools can offer everything from big data analytics to centralized forensic visibility to artificial intelligence-driven behavior analytics. It can be a challenge to choose the tool that fits agency requirements.
There are several important things to consider when choosing a SIEM solution. Some are more obvious than others, such as scalability; federal IT pros understand the importance of investing in a tool that will grow as agency needs grow.
Other things to consider may be less obvious, but just as important, such as:
• Does the SIEM provide enough native support for all relevant log sources? It will be assimilating a lot of data from a lot of different sources. Be sure the chosen toolset matches well with the types of devices from which it will be collecting and analyzing information.
• If the SIEM doesn’t have native support for a relevant log source, how quickly and easily can it be created, and can it support custom log sources for those applications that the agency has developed in house? Choose a tool that can easily be extended to support new data sources as needed.
• How well, and quickly, can the SIEM tool analyze data? The more quickly the federal IT security team can identify and contain threats, the more secure the agency and mission. Reducing the time to detection (TTD) is critical to prevent exposure, data loss, and compromise. Choose a SIEM tool with the ability to provide advanced analysis quickly, with little security team intervention.
• Does the SIEM include useful and relevant out-of-the-box reports that are easy to use? The value in a single-pane-of-glass approach provided through SIEM software is the ability to see one report or one chart that encompasses a vast amount of data. Be sure the agency’s chosen tool provides templates that can be easily implemented and just as easily customized where necessary. The more quickly the tool gets up and running, the more quickly security threats can be identified and thwarted.
• Does the SIEM make it easy to explore the log data and generate custom reports? Out-of-the-box reports are always useful, but sometimes questions are asked that require the federal IT pro to dig a little deeper and run a more customized view to show management and auditors. Choose a tool that simplifies the data exploration and reporting function to help you get answers quickly and with minimal effort.
Conclusion
There is no “silver bullet” in cybersecurity. The bad guys continue to get smarter, they are well funded, and they know that most federal agencies are not funded well enough to thwart their continuously changing tactics. As the world becomes more interconnected and complex, and as cloud and Internet of Things (IoT) devices become part of the federal landscape, federal agencies need to be thoughtful and smart about how they combat the threats that are actively targeting them.
A SIEM tool can dramatically ease the burden of every federal IT pro, saving valuable time and providing an additional security checkpoint across the agency’s systems.
Author bio: Jim Hansen is VP Products, Security at SolarWinds. He has 18 years of experience building and delivering simple and easy-to-use software solutions in the security market. He is passionate about customers, understanding their needs, and delivering solutions that make their jobs easier and their infrastructures and data more secure.
