RESOURCES
May 2024 has been a significant month for the Security Information and Event Management (SIEM) market. The highly anticipated Gartner Magic Quadrant was released on May 8th, followed by two major developments involving two of the five Magic Quadrant leaders: (1) Exabeam and LogRhythm announced a planned merger, and (2) Palo Alto and IBM revealed a partnership, where Palo Alto is to acquire IBM's cloud SIEM assets.
Indeed, the SIEM market never lacks excitement, whether it's mergers and acquisitions or technological innovation. Several past developments were due to:
- Some technology providers not being innovative enough. For example, certain vendors were slow to integrate Security Orchestration, Automation, and Response (SOAR) and User and Entity Behavior Analytics (UEBA) features. Some lagged in creating an ecosystem for application development, and/or offering cloud-native infrastructures.
- Another reason for major shifts or disappearing vendors is related to usability features. The absence of features that could simplify everyday operations like log collection, detection rule engineering, and alert triage has been problematic.
- Finally, the SIEM market has to contend with the rise of tangential fields such as Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), and SOARs, which might take over some of the SIEM functions.
SIEM are among the top five most invested cyber security technologies for the past 15 years. It plays a critical role in detecting abnormal behaviour and thus attacks progressing in networks. Christopher Crowley of the SANS Institute releases a highly insightful SOC survey report (1) each year. One of the key insights these reports consistently present is the users' preference for using SIEMs mainly for detection (SIEM over other technologies and detection over functions such as response). This is where things become somewhat complicated and contradictory. Even though SIEMs are the preferred detection technology, user satisfaction rates are not necessarily high.
Recent developments demonstrate the need for further commercial efficiency requirements, and that SIEMs must deliver more value to their customers to maintain its dominant position in the market. If SIEM “means” detection, practitioners need to successfully handle two fundamental requirements, with all other tasks following suit:
(1) Companies must have a streamlined, consistent and insightful log flow.
(2) Detection rules should be properly managed, updated, and retired in accordance with changing adversarial TTPs and business requirements.
At Cynode, we offer a variety of services to support SIEM users, helping them achieve the best detection through their SIEMs:
(1) We establish threat centric validation integrations to continuously assess whether there is inadequate logging against real-life threats, which could lead to insufficient detection. The service identifies any gaps in the log source or handling within the SIEM.
(2) We set up threat centric and analysis based detection rule validation integrations. These validations reveal conflicting and obsolete rules, as well as missing rules that could result in overlooked key security events. We address detection gaps by supplying either vendor specific (for supported vendors) or Sigma rules.
(3) We can handle SIEM management entirely. Our expert SOC team can serve as your extended team for SIEM management.
(4) Our cyber advisors can help you select your detection technology, whether it is EDR, SIEM, XDR, or others.
We will publish subsequent blogs to provide more insight into these areas. Stay tuned!
Further reading:
https://cynode.com/services/proactive-hardening-services/siem-validation-hardening
Resources:
https://www.sans.org/white-papers/sans-2022-soc-survey/
-
Regular EDR Policy Tuning
The cyber security world has recently focused on EDR technology due to its significant impact across industries. This post explores the evolution from early antivirus software to EDR platforms. Key milestones include the introduction of commercial antivirus software in 1987, the emergence of heuristic and behavioural detection methods in the early 2000s, and the development of Next-Gen Antivirus (NGAV) in 2010. EDR solutions, emerging around 2013, are crucial for detecting, investigating, and mitigating security threats but require regular policy updates and meticulous tuning for optimal performance.
-
Mastering Log Management: Enhancing SIEM and SOC Efficacy
Efficient log management is critical for SIEM and SOC efficacy. Challenges include log agent malfunctions, configuration errors, and network issues. This blog explores four log problem categories, from detection failures to incomplete logs, and introduces innovative solutions for proactive threat detection and response. Learn how Cynode's integrated threat simulation and log validation processes ensure optimal log coverage and enhanced security monitoring. Stay ahead of cyber threats with robust log management practices.
-
Understanding WebApp Exposure
WebApp Exposure Monitoring involves regular assessments and updates to perimeter defence platforms like WAF policies, ensuring alignment with the latest threat intelligence. Having a proactive stance to WebApp attacks is crucial as cyber threats incredibly fast, often outpacing traditional security defences. The process of continuously monitoring web applications allows organisations to more readily detect anomalies and respond to threats in real-time, minimising the risk of data breaches and other cyber incidents.
-
Introduction to Managed Security Service Providers (MSSPs)
Businesses increasingly struggle with cyber security management, especially with limited resources. Managed Security Service Providers (MSSPs) like Cynode offer comprehensive, efficient solutions, managing everything from security infrastructure to incident response, often using cloud services for cost efficiency. This article explores the benefits and services MSSPs provide, underscoring their importance in modern cyber security strategies.
-
Welcome Konrad Falk as Our New Senior Cyber Advisor & Architect!
Konrad brings extensive experience in Cyber Security and IT, with a background in programming, networking, and security. Passionate about securing companies and educating others, he values the trust of our leadership and is eager to manage security incidents and tackle evolving threats hands-on.
-
“Trust me, I was an engineer” – Björn Nilsson
We are pleased to announce Björn Nilsson as the new Head of Security Operations Sweden at Cynode. His extensive experience in cyber security and IT infrastructure marks a significant milestone in enhancing our capabilities. Björn brings a wealth of expertise from various critical roles within the industry.
-
Cynode Boosts Team with Gustav Bivstedt's Technical Expertise
Cynode hires Gustav Bivstedt as a Cyber Advisor to enhance our Cyber Advisory and Assurance Services. His expertise strengthens our technical capacity and supports business growth, including new offerings in security testing, cyber maturity assessments, and proactive risk management with Cyber Threat Intelligence.
-
Meet our "VP of Product" Cumhur Hatipoglu
As Cynode’s CMO, I am constantly impressed by our team's innovation and engagement. Cumhur Hatipoglu, our new VP of Product, enhances our mission to innovate in cyber security and MDR services. His approach integrates NIST CSF and best security practices to ensure our solutions meet clients' evolving needs.
-
Hacking and Cyber Warfare Go Hand in Hand
Sweden, amidst its NATO application and tensions with Russia and Turkey, has experienced a rise in political cyber-attacks. Groups such as Anonymous have targeted governmental infrastructures, leading to data leaks. Escalation of cyber-crime and nation-state backed cyber warfare necessitates global enhancement of defense measures.
-
EU updates NIS Directive. Are you compliant?
The European Union introduced the NIS 2 Directive to improve the cyber security of critical infrastructure systems within its member states and to ensure that digital service providers and operators of essential services have adequate security measures in place to secure their networks and data.
-
Rise of Cyber Due Diligence in M&A Processes
Sweden's post-pandemic economic recovery has spurred M&As. Cynode emphasises integrating cyber due diligence to address vulnerabilities, protect essential information, and optimise security spending, enhancing the security posture before, during and after M&As.