Welcome!

Related Topics: @CloudExpo, Microsoft Cloud, Containers Expo Blog, Agile Computing, Cloud Security, @BigDataExpo

@CloudExpo: Article

How Cloud-Based SIEM Frees That One Hand Tied Behind Your Back

Changing the culture from reactive to proactive security strategies

Have you ever been asked to fight the state boxing champion with one hand tied behind your back? Or metaphorically experience the old adage of bringing a knife to a gunfight? Many security professionals face this scenario every day.

For many companies with whom I talk, there isn’t a lack of IT talent when it comes to security--just a lack of hours in the day, computing resources and necessary headcount with specific expertise to change the culture from reactive to proactive and strategic risk management. Executives simply expect IT security to do more with less.

But the ability to recruit and retain security experts is an issue in itself. At the MSPAlliance meeting this week in Orlando, it was reported that the unemployment rate for such professionals is less than 1%. The salary for these specialists has doubled in the past three years. No wonder there is a critical shortage to feed this growing monster. And executives are still wary to spend budget on security line items-including staffing. It is still regarded (mistakenly, I might add) as a cost center.

It is that reason why SIEM isn’t more prevalent in security initiatives. It’s expensive. It’s resource-intensive. It's too complex. It's difficult to implement. It's difficult to configure. Customization takes advance training, it take time, takes skills…Many security professionals recognize it can be a game changer, but in terms of bang for the buck, it tends to stay on the wish list. Organizations need to reprioritize and reconsider SIEM as one of the pillars of enterprise security strategy—a cornerstone that correlates across silos and countermands each one of the criticisms noted above.

We recognize risk is rising. From every survey, report and anecdote, security issues are becoming a more significant and louder talking point.  Everything from the introduction of new technologies, the morphing of infrastructures beyond network perimeters, to threats of breach, shadow IT and other internal vulnerabilities indicates that managing a firewall and filtering email is not enough.  This is not to ratchet up the rhetoric to encourage investment in security solutions, but a chance to reprioritize security and evaluate how and when a SIEM initiative might enhance capabilities without the cost and resource baggage so many apply to it.

Let’s also recognize that traditional deployments of SIEM are just not feasible for far too many companies. On premise options are cost-prohibitive. The time to monitor activity (especially in real time) is overly demanding considering other priority responsibilities. The expertise to integrate and correlate data across multiple silos and leverage their layered results into strategic action is a skill set very high in demand and hard to capture. And If I have security budget at all, I am going to invest in options in which the scope is fully affordable, manageable and fully functional. In security, solving 50% of the problem still leaves you 50% vulnerable.  All true, until you consider cloud security options.

Cloud-based SIEM certainly alleviates many of the above issues dealing with cost, deployment issues, scope fulfillment and the necessary expertise to monitor your network.

When evaluating SIEM initiatives there are a few requirements you need to consider so that you pick the best tool and process combination to close the vulnerability gap in a company. From a functionality standpoint you need a strong correlation engine. This is the foundation of situational context which allows you to discern white noise and harmless burps from true suspicious activity. Intrusion detection security without context is simply driving with one eye closed---you lose depth perception and true threat understanding. You also need real time monitoring. Looking at logs a week later may suffice for compliance needs, but any threat discovered is a week old. Classic reaction mode—but it’s neither reaction nor response, it’s mop-up and repair. Unless SIEM or log archive has a time machine module, the damage is done.

With SIEM you also need clear scope—what do you want it to monitor, what are the parameters of data synthesis, what are the response and alert protocols? You also need a process for asset classification and prioritization, data normalization and categorization of data.

The beauty of cloud-based SIEM is that a true security as a service does all the heavy lifting. It is that expertise and additional headcount you need without the CapEx costs of hardware, software, salary and the soft costs of employee benefits, training, ramp time. With all the buzz about the of cloud and it’s lack of security…this IS that security. Cloud-based SIEM is not a porous app or some subscription service sitting exposed on a server in some lonely rural business park. A cloud-based SIEM must be an extension of your own strategy…it must provide enterprise-class capability on par with any alternative version (on premise, hybrid or otherwise). When evaluating these options, simply make sure they ‘re aligned with your expectations.

But I want to take this one step further. And it moves the focus beyond SIEM. Jon Oltsik, Senior Principal Analyst at the IT strategy firm ESG he said at a webinar I attended recently, “We need integration between tools and we need better intelligence.” And he’s absolutely right.

As I alluded earlier, must SIEM should tightly integrate with Log Management. I contend that is only part of the equation. SIEM should also leverage the data collected from other security cornerstones such as identity management and access management. This unified approach is the nexus of intelligence. When considering SIEM, you should ensure that it is configured so that it collaboratively leverages data from a variety of sources so it can give you visibility; give you the details to tell friend from foe from phish from phantom.

Yet this presents another set of issues. So many solutions create so many dashboards. It is highly likely a company has multiple security systems, each looking at its own sector (i.e. Identity management is only concerned with the provisioning and de-provisioning accounts).An IT professional can easily be overwhelmed with all the check points—and then responsible for the forensic analysis to see the overall threat landscape. Centralization in a cloud-based SIEM solves the issue. In a true unified platform, all the necessary data is correlated and filtered into a single centralized dashboard. This, in turn, creates the visibility that provides the intelligence which feeds the strategies and tactics to better secure a network and all its proprietary assets.

The other issue is cost. I just recommended a company not only needs to invest in SIEM, but log management, access management, SSO and identity management. Again, I point to the cloud as the answer. By bundling these solutions as a single source, unified platform delivered and managed from a multi-tenant cloud, not only are the cost savings palpable, but the immediate deployment kick starts any initiative (you don’t have to wait a year or three to fully realize the benefits of an enterprise solution). You gain so many more capabilities you would have otherwise not been able to apply.

And with the influx of new complexities, increased threat landscapes, relentless compliance pressures, and the acknowledged critical skill shortage to address those complexities, there is a growing acceptance for security delivered from the cloud.

In a recent survey, it was shown that organizations with more sophisticated security initiatives are more vulnerable. I realize it flies in the face of reason. The answer is their sophistication creates enhanced visibility. Enhanced visibility gives them a better vantage over the threat landscape…in short they see what’s coming and can prepare strategic defenses. The point I wish to make is that this level of sophistication is affordable and manageable when applying cloud-based security tools. At the risk of being repetitive, this model creates relief in terms of infrastructure investment, removes the hurdles of configuration and implementation difficulties and diffuses maintenance and analysis complexities. Most importantly, it builds in the necessary expertise—security-as-a-service, than creates the intelligence without the additional financial outlay. It gives you a fighting chance…with both hands free.

Kevin Nikkhoo
Fighting the fight with both hands free!

www.cloudaccess.com

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

Latest Stories
SYS-CON Events announced today that Isomorphic Software will exhibit at DevOps Summit at 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Isomorphic Software provides the SmartClient HTML5/AJAX platform, the most advanced technology for building rich, cutting-edge enterprise web applications for desktop and mobile. SmartClient combines the productivity and performance of traditional desktop software with the simp...
DevOps at Cloud Expo, taking place Nov 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long dev...
Is the ongoing quest for agility in the data center forcing you to evaluate how to be a part of infrastructure automation efforts? As organizations evolve toward bimodal IT operations, they are embracing new service delivery models and leveraging virtualization to increase infrastructure agility. Therefore, the network must evolve in parallel to become equally agile. Read this essential piece of Gartner research for recommendations on achieving greater agility.
Personalization has long been the holy grail of marketing. Simply stated, communicate the most relevant offer to the right person and you will increase sales. To achieve this, you must understand the individual. Consequently, digital marketers developed many ways to gather and leverage customer information to deliver targeted experiences. In his session at @ThingsExpo, Lou Casal, Founder and Principal Consultant at Practicala, discussed how the Internet of Things (IoT) has accelerated our abil...
SYS-CON Events announced today that 910Telecom will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Housed in the classic Denver Gas & Electric Building, 910 15th St., 910Telecom is a carrier-neutral telecom hotel located in the heart of Denver. Adjacent to CenturyLink, AT&T, and Denver Main, 910Telecom offers connectivity to all major carriers, Internet service providers, Internet backbones and ...
With so much going on in this space you could be forgiven for thinking you were always working with yesterday’s technologies. So much change, so quickly. What do you do if you have to build a solution from the ground up that is expected to live in the field for at least 5-10 years? This is the challenge we faced when we looked to refresh our existing 10-year-old custom hardware stack to measure the fullness of trash cans and compactors.
Extreme Computing is the ability to leverage highly performant infrastructure and software to accelerate Big Data, machine learning, HPC, and Enterprise applications. High IOPS Storage, low-latency networks, in-memory databases, GPUs and other parallel accelerators are being used to achieve faster results and help businesses make better decisions. In his session at 18th Cloud Expo, Michael O'Neill, Strategic Business Development at NVIDIA, focused on some of the unique ways extreme computing is...
The emerging Internet of Everything creates tremendous new opportunities for customer engagement and business model innovation. However, enterprises must overcome a number of critical challenges to bring these new solutions to market. In his session at @ThingsExpo, Michael Martin, CTO/CIO at nfrastructure, outlined these key challenges and recommended approaches for overcoming them to achieve speed and agility in the design, development and implementation of Internet of Everything solutions wi...
With over 720 million Internet users and 40–50% CAGR, the Chinese Cloud Computing market has been booming. When talking about cloud computing, what are the Chinese users of cloud thinking about? What is the most powerful force that can push them to make the buying decision? How to tap into them? In his session at 18th Cloud Expo, Yu Hao, CEO and co-founder of SpeedyCloud, answered these questions and discussed the results of SpeedyCloud’s survey.
19th Cloud Expo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterpri...
To leverage Continuous Delivery, enterprises must consider impacts that span functional silos, as well as applications that touch older, slower moving components. Managing the many dependencies can cause slowdowns. See how to achieve continuous delivery in the enterprise.
Actian Corporation has announced the latest version of the Actian Vector in Hadoop (VectorH) database, generally available at the end of July. VectorH is based on the same query engine that powers Actian Vector, which recently doubled the TPC-H benchmark record for non-clustered systems at the 3000GB scale factor (see tpc.org/3323). The ability to easily ingest information from different data sources and rapidly develop queries to make better business decisions is becoming increasingly importan...
Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more business becomes digital the more stakeholders are interested in this data including how it relates to business. Some of these people have never used a monitoring tool before. They have a question on their mind like “How is my application doing” but no id...
Kubernetes, Docker and containers are changing the world, and how companies are deploying their software and running their infrastructure. With the shift in how applications are built and deployed, new challenges must be solved. In his session at @DevOpsSummit at19th Cloud Expo, Sebastian Scheele, co-founder of Loodse, will discuss the implications of containerized applications/infrastructures and their impact on the enterprise. In a real world example based on Kubernetes, he will show how to ...
SYS-CON Events announced today Telecom Reseller has been named “Media Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.