The CISO’s guide to choosing the right SIEM: How (some) SIEMs have evolved to serve CISO

Cybersecurity has evolved into one of the most important departments in any organization. Forty years ago, long before connectivity was ubiquitous, IT security involved ensuring the computer room was locked so criminals couldn’t steal the floppy disks or punch cards.

Fast forward to 2022, and ‘Chief Information Security Officer’ (CISO) is a common job title. The CISO is responsible for thousands (and possibly hundreds of thousands) of IT devices scattered over vast geographic regions that need protection from attackers who could be located anywhere on the planet. And this goes on 24 hours a day, seven days a week, without any breaks or any relief.

The continuous threat of attack means modern infrastructures rely on sophisticated security products to keep an eye on traffic and differentiate between legitimate day-to-day activities and potential malicious activity. Known as a SIEM, or Security Information and Event Management, these products are designed to detect threats and manage security incidents by sifting through vast quantities of organizational data traffic.

Choosing a SIEM

One of the most important decisions the CISO will make is choosing a SIEM that is the right fit for their organization. Factors include the size of the organization, the complexity of its infrastructure, the types of applications being used, the volume of alerts that are produced, and the number of security staff at the CISO’s disposal. Compliance regulations are also a factor because some industry verticals require logs and network activities to be stored for set periods of time.

CISOs are risk managers. They need to decide how to best protect their organization and comply with regulations using a finite budget. It’s a balancing act between providing access to resources so the organization can function, and protecting those resources from unauthorized and potentially malicious parties.

One of the CISO’s most important tool is the SIEM. CISOs have a high degree of flexibility and choice of the kind of SIEM they choose to deploy. Some solutions split into separate applications that are developed by a large variety of vendors, while others come as a complete platform. Some SIEMs are based on-premises and managed by the internal IT team, while others are located in the cloud. Pricing also varies greatly, with some vendors charging based on the amount of data the system has to analyze.

One of the most important recent developments in SIEM technology is artificial intelligence (AI). AI uses high-end computing power to analyze all the information passing through the system and then contextually decide which activities and alerts are actual threats that need to be investigated by a human.

This is critical to modern security, particularly for enterprises. Large organizations can generate millions of alerts every day, the majority of which are not linked to a real-world threat. If humans were required to sift through all the logs to manually make sense of what is happening on the infrastructure, the job would be impossible, especially in real-time.

According to an article on Forbes last year, two of the most common complaints about SIEMs are their cost and complexity.

Cost becomes a major factor when companies are charged depending on the volume of data they monitor. In order to control data costs, CISOs often have to choose which areas of the network to monitor—and what parts to ignore.

Complexity can easily get out of hand if the SIEM is made up of separate applications, each of which need expert configuration to set up and configured so they can communicate with each other.

Get started and achieve ROI – Fast!

Here at Logrhythm, we have been developing security tools for almost 20 years and our SIEM platform has been specifically designed to make life as easy as possible for the modern CISO. We offer SIEM, SOAR & UEBA out of the box, so you can get up and running quickly and start seeing the returns on your SIEM investment quickly.