The Guidelines to Adopt an Applicable SIEM Solution

• 作者: Daniele Debertol Ermete Meda Hassan Mokalled Rodolfo Zunino Rosario Catelli Valentina Casola
• 来源期刊: 信息安全(英文)
• 学科: 工学
• 关键词: SIEM SECURITY Information and EVENT MANAGEMENT Requirements Evaluation CYBERSECURITY
• 年，卷（期）: 2020,（1）
• 页码范围: 46-70
• 页数: 25页
• 分类号: TP3

摘要

The need for SIEM (Security Information and even Management) systems increased in the last years. Many companies seek to reinforce their security capabilities to better safeguard against cybersecurity threats, so they adopt multi-layered security strategies that include using a SIEM solution. However, implementing a SIEM solution is not just an installation phase that fits any scenario within any organization;the best SIEM system for an organization may not be suitable at all for another one. An organization should consider other factors along with the technical side when evaluating a SIEM solution. This paper proposes an approach to aid enterprises, in selecting an applicable SIEM. It starts by suggesting the requirements that should be addressed in a SIEM using a systematic way, and then proposes a methodology for evaluating SIEM solutions that measures the compliance and applicability of any SIEM solution. This approach aims to support companies that are seeking to adopt SIEM systems into their environments, suggesting suitable answers to preferred requirements that are believed to be valuable prerequisites an SIEM system should have;and to suggest criteria to judge SIEM systems using an evaluation process composed of quantitative and qualitative methods. This approach, unlike others, is customer driven which means that customer needs are taken into account when following the whole approach, specifically when defining the requirements and then evaluating the suppliers’ solutions.