Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Five Best and Five Worst Practices for SIEM<br />Dr. Anton Chuvakin<br />Principal @ SecurityWarrior, LLC<br />(until July...

Outline<br />Quick SIEM Introduction<br />SIEM Pitfalls and Challenges<br />SIEM “Best Practices”<br />SIEM “Worst Practic...

SIEM?<br />Security Information and Event Management!<br />(sometimes: SIM or SEM) <br />

SIEM and Log Management <br />LM:<br />Log Management<br />Focus on all uses for logs<br />SIEM: <br />Security Informatio...

What SIEM MUST Have?<br />Log and Context Data Collection<br />Normalization<br />Correlation (“SEM”)<br />Notification/al...

I can tell you how to do SIEM <br />RIGHT!<br />

The Right Way to SIEM<br />Figure out what problems you want to solve with SIEM<br />Confirm that SIEM is the best way to ...

The Popular Way to SIEM…<br />Buy a SIEM appliance<br />

Got Difference?<br />What people WANT to know and have before they deploy a SIEM?<br />What people NEED to know and have...

What is a “Best Practice”?<br />A process or practice that<br />The leaders in the field are doing today<br />Generally le...

BP1 How to Plan Your Project?<br />Goals and requirements (WHY)<br />Functionality / features (HOW)<br />Scope of data col...

BP2 LM before SIEM!<br />If you remember one thing from this, let it be:<br />Deploy Log Management BEFORE SIEM!<br />“Dep...

Graduating from LM to SIEM<br />Are you ready? Well, do you have…<br />Response capability and process<br />Prepared to re...

BP3 Initial SIEM Use<br />Steps of a journey …<br />Establish response process<br />Deploy a SIEM<br />Think “use cases”<b...

Case Study: Good Initial SIEM Use<br />Example: cross-system authentication tracking<br />Scope: all systems with authent...

BP4 Expanding SIEM Use<br />First step, next BABY steps!<br />Compliance monitoring often first<br />“Traditional” SIEM us...

“Quick Wins” for Phased Approach<br />Phased <br />approach #1<br />Collect problems<br />Plan architecture<br />Start col...

Plan architecture

Start collecting

Start reviewing

Solve problem 1

Plan again</li></li></ul><li>What is a “Worst Practice”?<br />As opposed to the “best practice” it is …<br />What the lose...

WP for SIEM Planning<br />WP1: Skip this step altogether – just buy something<br />“John said that we need a correlation e...

Case Study – Just Buy a SIEM!<br />Medium-sized financial company <br />New CSO comes in from a much larger organization<b...

WPs for Deployment<br />WP3: Expect The Vendor To Write Your Logging Policy OR Ignore Vendor Recommendations<br />“Tell us...

Case Study: Shelfware Forever!<br />Financial company gets a SIEM tool after many months of “evaluations”<br />Vendor SEs ...

Summary of Practices<br />“Best Practices”<br />Follow a logical SIEM deployment process<br />Log management before SIEM!<...

SIEM Reminders<br />Cost countless sleepless night and boatloads of pain….<br />No SIEM before IR plans/procedures<br />No...

Conclusions<br />SIEM will work and has value … but BOTH initial and ongoing time/focus commitment is required<br />FOCUS ...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Implementing and Running SIEM: App... by Anton Chuvakin 12920 views
Beginner's Guide to SIEM by AlienVault 25926 views
QRadar, ArcSight and Splunk by M sharifi 22195 views
SIEM Architecture by Nishanth Kumar Pathi 26078 views
Security Information and Event Mana... by k33a 47326 views
How to Choose the Right Security In... by IBM Security 8331 views

View on Slideshare

1 of 29 Ad

View on Slideshare

1 of 29 Ad