|
By Bozidar Spirovski
Evaluating security information event management (SIEM) solutions is important, as they come in a lot of different flavors. The industry is not yet mature, and the competitors are pushing their own solutions, based on their background and capabilities.
In general, they will all present more or less the following configuration model for the SIEM implementation:
But other than the generic model, a lot of things are different. So, in order to sift through the multitude of solutions, the buyer needs to ask the real questions. Here are some of the key questions that need to be taken into consideration:
Is it possible to place an agent on the server machines? Certain SIEM solutions do not properly support remote collection of OS or application logs so they need a server side agent to do the job. On the other hand, most business critical systems are tightly controlled and do not allow for additional resident programs to be installed on the system for the risk of possible performance or reliability issues
Are there any custom applications that generate logs that need to be collected by the SIEM? The organization may require that the SIEM also collects and parses such logs, but proper parsing ability needs to be verified with a large sample of logs during a proof-of-concept run.
Is there any international standard or regulation that is mandating the SIEM solution? Whatever standard needs to be met has a set of predefined controlling reports that confirm compliance to the standard. You need to confirm that the SIEM solution can produce the needed reports.
How long will you need to keep logs and conclusions online and offline? Data retention is key to such a massive collection of information. Typically, a SIEM system needs to be able to archive all historical events to external data storage, and preferably, the archival process should include an integrity control (MD5 or SHA1 hash) that guarantees that the logs haven't been tampered with while in archive.
Proper answers to these questions will most likely eliminate the non-acceptable solutions, and will ease the evaluation process of the qualifying shortlist.
Copyright © 2008 To Present · Information-Security-Resources.com
Bozidar Spirovski is an information security expert with Information Security Short Takes.
Only registered users can write comments.
Please login or register. |
