SIEM solutions and SOCs: a UK guide for better cyber security and compliance
Overview – a UK guide to SIEM solutions and SOCs
SIEM solutions and SOCs (Security Operations Centres) offer UK organisations the opportunity to improve their cyber security and compliance, with standards such as PCI DSS, ISO 27001 and Cyber Essentials. This guide explains what they are, how they work, and how they help keep UK organisations more secure.
SIEM solutions
What is a SIEM solution?
SIEM stands for Security Information and Event Management. A SIEM solution works by collecting logs from multiple devices across a network and amalgamating the data into a usable form. This includes identifying activity that is abnormal.
What does a SIEM solution do?
SIEM solutions enable the monitoring and analysis of data from a wide range of sources. They help you cut through the noise and make the data useful. For example, they can identify vulnerabilities and suspicious activity. SIEM solutions also keep a record of all activity in case forensic analysis is required.
How are SIEM solutions useful?
SIEM solutions help security teams (often described as a Security Operations Centre – see below) to identify and address vulnerabilities, as well as responding quickly to potential threats and accessing key information from the past for the purposes of forensic analysis – or to achieve compliance requirements more easily.
How do SIEM solutions work?
SIEM solutions undertake a number of key functions in order to deliver the information required by security teams.
- Collect data. SIEM solutions use collection agents to collect log data from a variety of sources in the client environment. These may include devices, servers, firewalls and other equipment.
- Store data. SIEM solutions store some or (for example in the case of Monikal) all log data. This enables extensive analysis and historical review where this is required.
- Understand what is ‘normal’. SIEM solutions ‘learn’ their environment through a combination of data collection and added rules or policies. This means a user can tell the SIEM solution what normal would look like so it can identify and alert staff if something unusual takes place.
- Consolidate and correlate. SIEM solutions are able to analyse a wide range of data from a large number of sources and make sense of it, including flagging the severity of potential incidents.
Examples of how SIEM solutions help improve cyber security and compliance
A SIEM solution could help you identify or respond to the following situations:
- A member of your team downloads your whole client database onto a USB stick
- Someone logs into your CEO’s email account from China and then, just five minutes later, your CEO logs in from London
- A junior member of your team escalates their privileges and gains access to confidential data
- An intruder within your systems changes a system event log in an attempt to cover their tracks
- Any of your systems are not correctly time synchronised – important for forensic analysis etc.
- Detection of attacks at system boundary (firewall etc.)
- Employees are attempting to visit blocked websites which may host malware etc.
- There is an increase in user account lockouts, indicating possible brute force authentication attacks
- There is an increase in successful authentication user sessions via remote access, this could be an indicator of possible insider threats etc.
- The status of backup activities, prolonged failures could impact disaster recovery readiness
- There is a change to protected asset access, changes could indicate malicious activity
- There are an excessive amount of out-of-hours remote access attempts, excessive attempts could be an early indicator of things such as industrial espionage
- Critical or high vulnerabilities exist on systems and have not yet been patched
Choosing a SIEM solution – why Monikal?
Monikal is the first SIEM solution designed in the UK specifically for the needs of mid-level organisations.
It is built on world-leading technology from Assuria – a supplier to enterprise-level organisations and governments around the world. So Monikal is right up there in terms of its technology. However, everything we have done in developing Monikal has been designed to meet the needs of mid-level and growing organisations. From the onboarding to the pricing to support, we understand businesses that might not traditionally have been in the market for an enterprise-level SIEM solution, but need and deserve the same benefits. Monikal is for those kinds of companies and organisations.
Benefits of the Monikal SIEM
Monikal has a number of significant benefits including:
- Ability to detect and respond to cyber threats
- Increased resilience to external and internal threats
- Identification of criminal or negligent behaviours
- Insight and intelligence about user behaviours
- Full recording of all network activities
- Regular cost-efficient vulnerability scanning
- Monitoring and reporting in line with PCI DSS requirements
- Reports on the 5 security controls required for Cyber Essentials Plus
- Forensic capabilities in the event of an incident
- Hosted in a Tier 1 UK data centre
- UK-based support
In addition to this, Monikal meets all the requirements recommended by the National Cyber Security Centre in the SIEM solution buying guide.
What is a SOC (Security Operations Centre)
A Security Operations Centre (or SOC) is a team responsible for security within an organisation. In this context, a SOC will be the team responsible for monitoring and responding to issues identified by the SIEM solution, which they will use to optimise the cyber security and compliance needs of the organisation.
How does a SOC work?
The way a SOC (Security Operations Centre) works will depend on the size and needs of a particular organisation. While an enterprise level organisation may have a full in-house team of specialist analysts, a smaller mid-level organisation may look to out-source the requirements of monitoring and responding to security incidents identified by a SIEM.
Examples of how a SOC can help cyber security and compliance
An effective SOC should mean a dedicated focus on an organisation’s security. For example:
- A SIEM might detect unusual login attempts and the SOC team will examine these. Then, they’ll identify if they are legitimate and, if not, can put in place additional procedures to minimise the likelihood of a breach
- A SIEM might show that certain devices – eg those of employees now working from home – have not had the latest software patches and as a result are now a security risk. The SOC team can then undertake these as a matter of urgency.
- A SIEM might show attempts to access the user account of an ex-employee – then the SOC team can investigate where these are coming from and ensure these and any related accounts from the same ex-employee are deactivated.
- A SIEM could be configured to show that an employee clicked on a malicious link in a phishing email. Despite safeguards being in place to prevent the download, the SOC team can address any training requirements to minimise the chances of this happening in future.
- A SIEM might show internal threat actors such as an employee who is logging onto their account and downloading data out of work hours. The SOC team can run reports to highlight this unusual activity and notify the client to investigate further.
Why the Securious Managed SOC solution is ideal for mid-level organisations?
Working in conjunction with our SIEM solution Monikal, Securious offers a managed SOC service especially tailored to smaller but ambitious and growing mid-level organisations in the UK.
Typically, these companies will have an IT director or CISO (chief information security officer). They may also have an in-house or managed IT service, but these will not be security specialists. Additionally, the senior personnel will not have the time available to monitor SIEM activity on a daily basis.
This is where the Securious Managed SOC service uniquely fills a gap. Securious will monitor the Monikal dashboard and respond to alerts of abnormal activity or vulnerabilities. They will notify the client when action is required with clear recommendations on what needs to be done.
The net result is a much more secure and compliant organisation. And this comes at a fraction of the spend of having a full-time in-house team.
How can I learn more about SIEM and SOC solutions?
If you would like to ask us anything about how a SIEM solution or managed SOC could help your organisation, give us a call or send a message using the form below.