{"id":2729,"date":"2019-07-31T09:27:35","date_gmt":"2019-07-31T13:27:35","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=2729"},"modified":"2019-11-20T13:53:07","modified_gmt":"2019-11-20T17:53:07","slug":"the-top-5-enterprise-siem-myths-revealed-and-debunked","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/the-top-5-enterprise-siem-myths-revealed-and-debunked\/","title":{"rendered":"The Top 5 Enterprise SIEM Myths – Revealed and Debunked!"},"content":{"rendered":"

\"The<\/p>\n

Enterprises believe SIEM<\/a> myths to their own peril; believing in them can hamper your cybersecurity in the long term. What are the top 5 enterprise SIEM myths? How can your enterprise instead embrace reality and improve your security analytic capabilities?\u00a0<\/span><\/p>\n

No branch of cybersecurity carries as much stigma as SIEM. Certainly, SIEM\u2019s capabilities and tools don\u2019t appear as straightforward as their cousins endpoint security and IAM. However, enterprises need SIEM capabilities now more than ever with the emphasis on detection in the cybersecurity paradigm.<\/span><\/p>\n


Widget not in any sidebars
<\/span><\/p>\n

Thus your enterprise can\u2019t let itself become blinded by inaccuracies. Therefore, we present the top 5 SIEM myths and why they don\u2019t correspond with reality.\u00a0<\/span><\/p>\n

The Top 5 Enterprise SIEM Myths – Debunked!\u00a0<\/b><\/h2>\n

Myth #1: My Small Business Doesn\u2019t Need SIEM\u00a0<\/b><\/h3>\n

Of all the SIEM myths we cover here, this one proves the most insidious. Small businesses continue to turn a blind eye to their cybersecurity risk. Often, they believe hackers only target large enterprises\u2014the ones that show up in the headlines. Of course, those headlines focusing on the breaches of the most recognizable brands only reinforces this notion.\u00a0\u00a0<\/span><\/p>\n

Unfortunately, this belief doesn\u2019t pan out in reality. In fact, hackers attack small-to-medium-sized businesses <\/span>more<\/span><\/i> than they target global enterprises. Anywhere between 58% and 61% of cyber attacks target small businesses. To compound the danger, 60% of data breaches end up causing the attacked SMBs to permanently close six months later.<\/span><\/p>\n

The obvious solution to this SIEM myth? Deploy SIEM<\/a>. Your enterprise, large or small, can\u2019t rely on a digital perimeter by itself to stay secure. Really, preventative cybersecurity can\u2019t hope to defend against 100% of all cybersecurity threats. Eventually, hackers will get lucky or attack you in a way you didn\u2019t anticipate. Once hackers do eventually break through the perimeter, your enterprise needs improved threat detection and remediation.\u00a0<\/span><\/p>\n

These capabilities, as well as network visibility, security alerting, and log management, SIEM can provide.<\/span><\/p>\n

Myth #2: We Can Just Set Our SIEM and Then Leave It Be<\/b><\/h3>\n

Granted, this also applies to all other branches of cybersecurity, not just SIEM. However, decision-makers tend to focus on SIEM when discussing this myth. The hope appears to be that they can set-it-and-forget-it, to invest their resources in other places. In their perfect world, they can just leave their solution alone and let it run optimally.\u00a0<\/span><\/p>\n

This doesn\u2019t work for any cybersecurity solution, much less SIEM. Instead, SIEM functions based on digital rules. These rules dictate how the solution correlates security events across all of the accumulated and normalized log data.<\/span><\/p>\n

In other words, correlation rules define what constitutes abnormal behavior or activity. From that, your solution then generates security alerts which in turn prompts your IT team to investigate.\u00a0<\/span><\/p>\n

Yet these correlation rules do not come automatically. Your IT security team must write and provide them. Even if the solution utilizes machine learning, your cybersecurity professionals must still set the foundation for its optimal performance.\u00a0<\/span><\/p>\n

Otherwise, your SIEM correlation rules may identify normal behaviors as potential security events, creating false-positive alerts. These can substantially drain resources, time, and willpower in wasted investigations and can obscure more legitimate security alerts.<\/span><\/p>\n

In addition to making clear correlation rules, your team needs to continually monitor your SIEM solution<\/a>\u2019s performance. Regardless, never assume you can just leave your solution alone; leave that to the dustbin of history with the other SIEM myths.\u00a0\u00a0<\/span><\/p>\n

Myth #3: When We Can Deploy SIEM All At Once!\u00a0<\/b><\/h3>\n

No. Just no. For your sake, and the sake of your IT security team, please do not give into SIEM myths like this. It only leads to heartache and serious burnout.\u00a0<\/span><\/p>\n

Here\u2019s why: SIEM functions based not just on its correlation rules but on the data you feed it. Feeding your SIEM security-related data results in more accurate alerts but more information can create more alerts and thus more false positives and investigations.\u00a0<\/span><\/p>\n

So the more of your network you incorporate into your SIEM\u2019s purview, the more you have to deal with proportionally.\u00a0 <\/span>
\n<\/span><\/p>\n

However, enterprises keep trying to deploy SIEM all across their networks all at once, with the requisite data influx. The influx of information leaves your IT team scrambling. Instead, you need to judiciously pick the most sensitive areas of your network which require greater visibility.<\/span><\/p>\n

Deploy your enterprise\u2019s SIEM solution in those areas first and learn how your correlation rules work. You can observe potential issues and unique normalization processes before you expand it to other network areas.\u00a0<\/span><\/p>\n

Of course, you can\u2019t limit your SIEM to only those areas. Don\u2019t rush into deploying SIEM, but choose a fitting solution quickly. Once you feel comfortable with your solution, you can always scale it to the rest of your network.\u00a0\u00a0\u00a0<\/span><\/p>\n

Myth #4: SIEM Costs Too Much<\/b><\/h3>\n

One of the most recurrent SIEM myths enterprises cite is cost. The initial upfront costs to a traditional SIEM solution include the licensing costs, implementation costs, and renewal costs. Additionally, your enterprise needs to consider the training costs for your employees to properly maintain the solution.<\/span><\/p>\n

However, these costs shouldn\u2019t prove extravagant compared to other cybersecurity solutions such as identity management and endpoint security. Usually, the real problems stem from enterprises continuing to sink money into their legacy solutions. Conversely, they may select a new solution but fail to invest the resources, time, or energy to maintaining their SIEM solution in the long term.<\/span><\/p>\n

In many ways, the perception of overwhelming SIEM costs creates a self-fulfilling prophecy. Enterprises believe SIEM will be too expensive to work with, and therefore become gun shy about investing in it properly.<\/span><\/p>\n

Therefore, consider deploying SIEM as a major long term investment in your overall cybersecurity and provide it with the time and energy it deserves. Additionally, the training SIEM requires will supplement your IT security team\u2019s strengths in the long term.<\/span><\/p>\n

Myth #5: SIEM Is Way Too Complex For Our IT Department<\/b><\/h3>\n

Complexity remains one of the most commonly referenced SIEM myths. The proper maintenance and optimal performance of SIEM solutions do carry more than the requisite amount of mystique. Questions abound:\u00a0<\/span><\/p>\n