The following is an extract from the searchsecurity.com sponsore by Arcsight, leader in SIEM segment.
SIEM 3.0
These changes and their impacts are causing many organizations to reconfigure their businesses. Security is becoming more challenging; to protect the business, monitoring becomes much more important. SIEM 3.0 can be a significant help with these new challenges.
SIEM 3.0
These changes and their impacts are causing many organizations to reconfigure their businesses. Security is becoming more challenging; to protect the business, monitoring becomes much more important. SIEM 3.0 can be a significant help with these new challenges.
Protecting the Business
SIEM 3.0 is not just about protecting the perimeter of the network, but about protecting the business, as Figure 5 illustrates. It is still necessary to protect the perimeter and the network, but it is most important to protect the overall business. To protect the business, it is essential to understand who is on the network, what data they are seeing, and which actions they are taking with that data, known as user monitoring, data monitoring, and application monitoring. SIEM 3.0 is about monitoring and understanding users, monitoring the information they look at, and monitoring the applications they touch.
Example Involving a Contractor
SIEM 3.0 can perform correlation on a transaction to help determine whether it is fraudulent.
For example, an IT contractor is completing his work at a company. Analyzing his activities raises several flags. First he has been using his badge to access the workspace after hours. His role in the identity management system is a contractor and generally it is against policy for this customer’s contractors to come in after hours. Correlating file system logs indicates that he has copied some confidential files from the NetApp filer. Finally, using firewall logs, correlating
that information helps determine that he has uploaded files to an unknown site. This monitoring
has enabled this customer to identify a contractor engaged in improper activity.
SIEM 3.0 is not just about protecting the perimeter of the network, but about protecting the business, as Figure 5 illustrates. It is still necessary to protect the perimeter and the network, but it is most important to protect the overall business. To protect the business, it is essential to understand who is on the network, what data they are seeing, and which actions they are taking with that data, known as user monitoring, data monitoring, and application monitoring. SIEM 3.0 is about monitoring and understanding users, monitoring the information they look at, and monitoring the applications they touch.
Example Involving a Contractor
SIEM 3.0 can perform correlation on a transaction to help determine whether it is fraudulent.
For example, an IT contractor is completing his work at a company. Analyzing his activities raises several flags. First he has been using his badge to access the workspace after hours. His role in the identity management system is a contractor and generally it is against policy for this customer’s contractors to come in after hours. Correlating file system logs indicates that he has copied some confidential files from the NetApp filer. Finally, using firewall logs, correlating
that information helps determine that he has uploaded files to an unknown site. This monitoring
has enabled this customer to identify a contractor engaged in improper activity.
Example Involving Compliance Violation
We investigated the computer activity of another company’s well-respected senior business analyst. Correlating identity information in the access directory with application access in the mainframe and the Oracle financials application shows some potential problems. This analyst has violated separation of duties restrictions and it is necessary to sort out the access rules to make sure this company is still in compliance with Sarbanes-Oxley.
Example Involving Account Takeover
This is a real situation involved a client of a bank who asked to wire funds from her account using the bank’s Website and her iPhone. At first the bank was pleased about the cost savings that come with selfservice, but some correlations showed possible issues. We examined the timing and saw that her account was only recently established. We also saw that it was a single-custody account so she could wire funds without a second signature and that the wiring address changed very recently. This banking customer found that their back-office employees were using newly established customer accounts to wire money out of the country and steal from customers. They did it by changing addresses and executing transactions in the period between when the accounts were established and when the new account paperwork was sent out.
