What on earth is a SIEM and why should I care? 

April 21, 2021

Cyber security is pretty heavy on the acronyms, which can make it feel inaccessible and highly complex for those without a background in tech. And okay, it is quite complicated when you drill down into the little details. But the principles behind it are very straight-forward – and important to get your head around if you run a business and want to protect your critical data (and reputation). 

Since we launched Monikal back in March, we’ve spoken to a lot of business-leaders who had never heard of a SIEM before (yes, that’s literally the name of the category of products and no, we don’t think it does it justice. It stands for Security Information and Event Monitoring – catchy, right?). A few of them were sceptical about how something that sounds so techy could solve some of the problems that were keeping them awake at night. 

So we thought we’d share a blog with a high-level explanation of what a SIEM is, how it works, and why business leaders should care. 

So here we go… 

What is a SIEM? 

In a nutshell, a SIEM is a tool that helps you and your team see what’s happening across your IT environment. We often say it’s a bit like high-tech CCTV for your IT, giving you visibility of everything that happens so you can respond to anything that looks suspicious. 

It also stores a record of activity, so should the worst happen, you have everything you need to conduct a retrospective forensic analysis, looking at what happened and how it happened, so you can decide on the best course of action. 

How does it work? 

  • First, it learns about your environment, establishing a baseline over a learning period, so it knows what normal looks like
  • It continuously collects and stores information about what’s happening across your network (both in and out of the office), and then it consolidates and correlates the data and presents it in a simple dashboard
  • It delivers full visibility of and insight into ever-changing and fragmented networks
  • By continuously monitoring your critical infrastructures, it provides deep security intelligence and visibility of critical threats
  • Which enables you to respond to threats quickly and effectively, stopping breaches before they happen and securing vulnerabilities before they’re exploited 

Why would I want a SIEM? 

Improve your cyber security

Not only can a SIEM help alert you to critical threats – like a user stealing your data or downloading malware to your network – but it can also look at lower-level activity that could turn into something serious down the line.

A report by IBM found that the average time to detect and contain a data breach is 280 days. The same report found that by containing a breach in under 200 days, you can save $1 million in costs. SIEM solutions can help you detect a breach quickly, which will allow you to mitigate damage, remedy the problem and significantly reduce the financial impact of the breach.

Meet your compliance requirements 

Businesses and organisations need to have logging and monitoring capabilities in order to meet the requirements of a number of internationally recognised standards.

For example, all organisations that store, transmit or process cardholder data need to be compliant with PCI DSS (Payment Card Industry Data Security Standard). PCI DSS requires you to track and monitor all access to network resources and cardholder data.

SIEM solutions provide log management and network monitoring capability, which enables you to meet all requirements of PCI DSS.

Another example is Cyber Essentials – a SIEM can help your organisation keep track of issues and should be able to provide regular reports on the 5 security controls required for Cyber Essentials certification – firewalls; secure configuration; user access control; malware protection, and patch management.

Whether you need to conform to PCI DSS, ISO27001, Cyber Essentials Plus or other standards, a SIEM should be able to provide you with compliant reports to help you meet the requirements.

Interested? 

If you’d like to learn more about how a SIEM solution could help you, get in touch for an obligation-free chat 🙂 

Read more on the monikal website