Cyphort And Ponemon Institute Study On SIEM Optimization

Cybersecurity experts commented on a new report issued by the Ponemon Institute and Cyphort, “Challenges to Achieving SIEM Optimization.”

Key findings include:

• 76 percent of respondents value their SIEM as a strategically important security tool
• Only 48 percent were satisfied with the actionable intelligence they get from their SIEMs
• 78 percent of the organizations surveyed have one or less full-time staff assigned to SIEM administration
• 64 percent or organizations pay more than $1 million annually for external consultants and contractors to assist with SIEM configuration and management

“The root of their dissatisfaction seems to be related to the complexity of the SIEM itself,” explained Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. “In fact, 75 percent of respondents said there is significant, or very significant, effort involved in configuring their SIEM for their organization. Obviously, this complexity can make it very difficult to extract the value they want and need.”

Péter Gyöngyösi, product manager at Balabit:

“Rogue insiders, departing or disgruntled executives and technology people have long been the nightmare of the security staff at any enterprise. This is reflected in the findings of research released by the Ponemon Institute last week who, after surveying security experts across the field,  found that malicious and negligent insiders are considered the greatest sources of potential cybersecurity risk. It’s an especially hard problem to tackle as in most cases these employees need access to the data and systems they start to access fraudulently.

There are three steps that can be taken to prevent or significantly lower the likelihood and impact of such problems. The first step is to implement a bullet-proof auditing of who did what on the critical systems, in a way that not even sysadmins or executives are able to turn off. This by itself can have a deterrent effect — if one knows that they have no way to erase their traces they might think twice before committing fraud.

The second step is to control access to critical services in a managed way. Shared accounts, passwords that are known by everyone or direct access to the domain controller are disasters waiting to happen. It must be possible to revoke one’s access to every service within the organization with a single click.

The third pillar should be the proactive monitoring and analysis of the activities of privileged users and privileged accounts. Behavior analytics can help security teams find anomalous events and strange accounts, such as the one created by the departing IT Director in this case with the added benefit of also being able to find cases when internal accounts are hijacked by external attackers.”

John Marshall, VP of Technical Services at STEALTHbits Technologies:

“SIEM adoption was initially driven by the need for a long-term archive for log files, not as a security monitoring solution per se.  Hence the ‘ingestion-volume’ based approach to licensing adopted by most vendors.  It is the volume of data now being directed at what has become a hybrid solution that limits their effectiveness and drives operational cost & complexity.

Vendor differentiation needs to be driven by a focus on new use-case centric capabilities around improving the quality of data inputs and for addressing the challenges of ongoing data management.”

Cyphort and the Ponemon Institute will present complete findings and analysis of this research, as well as an overview of the ADF, during a webinar on March 14 at 10:00am PT.  To register for this event, click here.  All webinar attendees will receive a full copy of the research report.  See also:  http://go.cyphort.com/Ponemon-SIEM-Webinar.html