1 Laconic Security, LLC West 120th Avenue, Suite 400 Broomfield, CO So, you wanna build a SIEM?

About Us Boulder based company specializing in SOC, security and data protection services. Founded 4 years ago as a professional services company We have built security operations centers for many industries (healthcare, retail, finance, telecommunications) Rigorous and systematic approach to building SOCs Soon to release our first software product (not a SIEM) 2

Agenda SEIM Defined Why Build a SEIM? $$$ Choosing the Right One It’s ALIVE! … Now What? Tips for Success 3

SIEM 101 Terminology and level-set 4

SIEM Defined Security Information and Event Management (SIEM) – AKA: SEM, SIM, SEIM A system to manage large amounts of security data – Aggregation, centralization, correlation, normalization SIEMs are typically appliances, software or both – SIEM architectures can even be mixed-vendor Help turn raw data into actionable information – Needle in the haystack Help people visualize data 5

What SIEMs Do Aggregate & normalize data to a central location Provide a “meta-language” for which to manage data Provide a graphical console view across all logging data Turn the lights on… 6 IDS Firewall AV Host Logs SIEM

What SIEMs Don’t Do 7

8 Provide what you want out of the box – High customization is best/worst feature Make you compliant (on their own) Run themselves – Much care and feeding required SIEMs don’t understand your business – people do

Why are you building a SIEM? Enterprise Security Driven – We want to “do the right thing” for our business – We need to get a better handle on our security logs Compliance Driven – We’ve been told by legal/PCI/FTC to… MSS Driven – We want to build a SOC to sell Managed Security Services to customers 9 Really Hard!

SOC or SIEM? Do you want a Security Operations Center (SOC) or SEIM? SOCs provide near real-time analysis of events - 8x5 or 24x7 – 4-5 people for an 8x5 – people for 24x7 A SIEM is present in a SOC, but SIEMs may satisfy your goal without SOC monitoring – Your goal may be to centralize logging. No need for a full-blown SOC. 10 Either way you slice it, SIEMs require operators

$$$$ SOCs and SIEMs are expensive! – Software licenses, analysts to monitor console, infrastructure upkeep There will be scope creep and therefore budget creep – People will love what you do for them Professional Services will be a requirement (one exception) – Bite the bullet now; you will be glad down the line – Bet on a 6-12 month engagement; 1-2 consultants (to go from nothing to a fully operational 24x7) Validate PS firm – What your methodology? How many have you built? In what industries? References? 11

Common Mistakes SIEMs will become shelfware if ignored No one dedicated to SIEM health – This is a full-time job Purchased to be a silver bullet No consulting time purchased No in-house expertise Under-estimate amount of work SIEMs actually require Project vs lifecycle mindset – SIEM is a lifecycle, just like security - not a project Waterfall approach to project management – Great SEIM implementations evolve – An agile team responds quickly and effectively to threats 12

13

How to Choose Understand your goals before talking with vendors Line up your requirements with vendor features Understand motives, hidden fees and exactly what you get – Maintenance fees, up-selling storage, total connections… Can you export your data to another system (if needed) Bake offs are valuable, but are time/resource heavy Check analyst reports (with caution) Talk to others using the product – Get references and follow up with them! Vendor POC 14

15 The sales presentation

16

18 What’s in the box…

Building Blocks Think of a SIEM as a box of Lego's or a bunch of electronic components – You can assemble these parts in endless configurations Need someone with a broad range of skills to assemble pieces – Understanding of SIEM capabilities and fundamentals – Training on how SIEM “meta language” functions – General security knowledge – Problem solving skills – Ability to move forward in a “good enough” mindset 19

20

It’s ALIVE! – now what? Who’s monitoring the console / infrastructure? When are hours of monitoring? What are you monitoring? Is it sensitive? Where are your consoles located? Is the room secured? Who’s writing SIEM content? What can you get from the logs you’re monitoring? – Use case development Who gets paged if there’s a problem?` How do you develop new content? Who’s testing new content for relevance? Who’s documenting everything? Where is your documentation? Is it backed up? 21

Viva la Wiki 22 Use a wiki – start a revolution Used properly, this is the single most helpful tool for SIEM users and SOC operators Expect a learning curve and time to adoption Don’t except imitators – MS Sharepoint is NOT a wiki A wiki will not solve every problem – Traditionally, wiki’s are not very good at document management

Use Cases The way we recommend documenting what you want to accomplish with the SIEM Comments first, then code – Just like an outline to a paper or book Provides a clear understanding of what you want and need to do with a SIEM 23

Anatomy of a Use Case occurs when is met resulting in which is remediated by 24 For example: DDOS Likely event occurs when Arbor fires 15 SYN alarms in 10 seconds resulting in a high- prority sent to the network team for remediation

25 Use Case - Visual Example

Training Program Ongoing training is essential for sustainability Analyst certification program in the wiki – All new-hires go through the program Presentation skills are required – Many times overlooked. Analyst must be able to communicate effectively to all levels from technical to executive management. A culture of learning – Brown bag lunch days, presentations Will be met with resistance, so be ready… 26

Tips for Success Show progress early and often Parade your wins – Everyone likes a parade Use a Wiki – start a revolution – Collaboration, process and procedure are key to longevity Have an internal analyst training program Remember: Garbage in-Garbage out – SIEM is only as good as the content you write for it Develop meaningful metrics – Know your audience Develop content around use cases Lead by example – Use the wiki, dig around in the SEIM, don’t be afraid to try new things 27

28 Fred Thiele Co-Founder, Laconic Security, LLC Laconic Security, LLC West 120th Avenue, Suite 400 Broomfield, CO