Security Information and Event Management (SIEM) Architecture
24.04.2019
Read
In information warfare, the need to develop SIEM architecture has become a crucial factor due to the existence of ever-growing cyber threats and their creators – cyber pests.
The SIEM (Security Information and Event Management) presents a broad range of products or services for the purpose of managing security information and security events simultaneously. SIEM also provides analysis of security alerts on a timely fashion. From a broad outlook, SIEM is useful for detecting security threats that are not visible to ISS (individual security system), investigating issues related to previous security breaches, performing immediate incident responses, and preparing reports to meet compliance requirements.
In order to facilitate effective and comprehensive functioning of SIEM, attention must be paid to its build-up i.e. its architectural technology and processes. As precisely and concisely as possible, this article aims at providing insights into the workings of SIEM architecture.
One of the main objectives of SIEM architecture is to maintain and manage system configuration changes, directory services, review and log auditing, both service and user privileges with the inclusion of incident response. In addition, the applications related to Identity and Access Management (IAM) must be updated on a regular basis to bolster system security and eliminate external threats. Moreover, the SIEM architecture must provide the capabilities to present, analyze, and collect information from network and security devices. The SIEM anomaly and visibility detection features are also worth mentioning. Detecting polymorphic code and zero-days, automatic parsing, and log normalization can establish patterns that are collected by SIEM visualization by utilizing the security events.
Figure 1: SIEM Architecture
The architectural aspect of SIEM basically is concerned with the process of building SIEM systems and its core components. In a nutshell, SIEM architecture encapsulates the following components:
Data management mostly deals with data storage and retention policies. Modern SIEMs rely on technologies that provide unlimited data storage capabilities such as Hadoop or Amazon S3. Data retention allows retaining of data for a specific time which is almost seven years. This data can be helpful for forensics of audit purposes.
As a result, it is pertinent to point out that traditional SIEM architecture used to be monolithic and expensive. However, the next generation SIEM is more affordable and offers better technological advantages through sophisticated software and cloud-based technology for effective security event management.
