SECURITY INFORMATION AND EVENT MANAGEMENT SIEM SECURITY INFORMATION AND EVENT MANAGEMENT Montgomery, Salvas, Shepardson

Overview Combines both security information management (SIM) and security event management (SEM) Provides real time analysis of security alerts Data aggregated for a single point of view TRENDS & PATTERNS most organizations today deploy a Security Incident and Event Management (SIEM) solution as a proactive measure for threat management, to get a centralized view of their organization’s security posture and for advanced reporting of security incidents Video - What is a SIEM?

       SIM                  vs.            SEM Automates collection of event log data from security devices  Detailed searching and reporting Long-term storage/analysis of LOG data Real-time monitoring/alerts Correlation of events SPECIFIC EVENTS Since SIM tends to be better at log collections, it can be used to drive or feed SEM solutions.

Benefits of SIEM Prevent/detect potential security breaches Reduce impact of security events Evaluate policy/IT compliance Improve incident handling efficiency 

How SIEMs Work Monitoring, Standards, Issues, Action

Monitoring End-user devices Network devices Security applications Ideally, a properly secured network should have multiple sources generating event logs. These should include sources like system logs from end-user devices, server and network device logs, and logs from various security applications (anti-virus, firewalls, intrusion detection software, etc.). A SIEM takes all these events and makes them accessible from one location.

Standards Normal activity Established exceptions Blacklisted actions A SIEM then takes all the log data and compares it to a set of pre-established standards. These are things like typical activity that shouldn't raise any alarms, actions that by pre-specified users that would otherwise cause concern, and actions that always warrant closer examination. In order for a SIEM to be the most effective, time needs to be taken to analyze network activity and determine what sort of network patterns make sense for the organization and what activity is unwanted. 

Issues and Actions Rating Method of notification Recommendations https://www.youtube.com/watch?v=fXBnjhpDXPE If the SIEM receives an event notification that falls outside the expected or acceptable standards, it will then rate the event on a scale according to its severity. Similar to the pre-determined acceptable activity, the severity of an action also needs to be set up ahead of time for a SIEM to work effectively. Once an event is rated, the SIEM determines who needs to be specifically notified and how, whether through adding the event to a log, highlighting it in a report, or sending an immediate alert. It will also provide recommendations on how an event may be resolved.

More layers! ITIL Information Technology Infrastructure Library contains a comprehensive set of best practices that are used to develop and execute IT service management. Business continuity planning is the process of creating systems of prevention and recovery to deal with potential threats to a company.

Examples A good SIEM gives you the ability to proactively analyze problems and take immediate action without having to manually gather, organize and sift through gigabytes of log data. Quickly Gain Insight Into Threat and Malware Activity Generally behavioural approach, considers individual events to be insufficient to draw conclusions

splunk> Index > Search and investigate > add knowledge > monitor and alert > report and analyze Splunk uses this thing called SPL (Search Processing Logic) which is pretty much like a combination of SQL queries and python or any other high level programming language

Example Use Case Detection of Possible Brute Force Attacks sourcetype="WinEventLog:Security" (EventCode=4625 AND "Audit Failure") NOT (User_Name="*$" OR Account_Name="*$") NOT Failure_Code=0x19 | stats count by Account_Name | where count > 2 Go into your local security policy, and start auditing logon events. This creates the necessary logs that can be fed into Splunk EventCode: 4625 is used in new versions of the Windows family like Win 7. In older versions, the event code for invalid login attempts is 675, 529. Failure Code 0x19 is error code 25 for Additional pre-authentication required* Since these activities gets logged in Win:Security, which in turn is feeding Splunk in real time, an alert will be created in Splunk, giving analysts an incident to investigate and take responsive actions, like changing the firewall policy to blacklist that IP. Failure Codes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

IBM QRadar Named best SIEM in 2015 by SANS Institute IBM QRadar Security Intelligence Platform

Resources http://resources.infosecinstitute.com/top-6-seim-use-cases/ http://searchsecurity.techtarget.com/definition/security- information-and-event-management-SIEM https://www.tripwire.com/state-of-security/incident- detection/log-management-siem/what-is-a-siem/ https://www.splunk.com