WIXLIB

OperationalizingInformation Security:Top 10 SIEMImplementer’s Checklistw w w. a c c e l o p s . c o m

Table of ContentsExecutive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3SIEM Best Practice #1 – Malware control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4SIEM Best Practice #2 – Boundary defenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5SIEM Best Practice #3 – Access controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7SIEM Best Practice #4 – Acceptable Use Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9SIEM Best Practice #5 – Application defenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11SIEM Best Practice #6 – Compliance and audit data requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13SIEM Best Practice #7 – Monitoring and reporting requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15SIEM Best Practice #8 – Deployment and infrastructure activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17SIEM Best Practice #9 – Network and host defenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19SIEM Best Practice #10 – Network and system resource integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20AccelOps Security Information & Event Management (SIEM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Executive SummaryBest Practices e-bookThis e-book lists 10 Best Practices to provide you guidance for successful SIEM implementation and optimize your resources and accelerateyour return on investment. Whether you need to streamline incident response, automate audit and compliance processes, better managesecurity and business risks, or build out your deployed SIEM —this e-book presents process, metrics and technology considerations relative toSIEM implementation and security operations. Below are key takeaways for each of the 10 best practices in the e-book:SIEM Best Practice #1 – Malware controlCentralize malware monitoring, incident responses, assessing andreporting operational impacts from end point to perimeter withregard to ensuring activation and standard use, monitoring andreviewing malware activity, and most importantly, responding toissues. Make sure to include all sources including anti-malwareapplications, anti-virus, anti-trojan, spam filtering, web filtering andwebsite scanners, DNS, IDS, VA and network flow operational data.SIEM Best Practice #6 – Compliance and audit data requirementsUnderstand applicable industry, regulatory and legal obligations forsecurity and risk management. Compliance reports and dashboardsshould be refined to support security analysts, internal and externalauditors and the CIO or CSO. Be aware of any technical constraintsthat may impact performing investigations—without being able totrace back and analyze the necessary data, a firm’s liability, penaltyand notification exposure may be greater than actual.SIEM Best Practice #2 – Boundary defensesConsolidate monitoring of access activity from various boundarydefenses such as firewalls, routers, VPNs and other networkresources as well as cross-correlating network flows with otheroperational data to identify suspicious behavior and potentialsecurity threats. Understand boundary definitions in eachorganization in terms of levels of risk, appropriate access grantsand monitoring interests. Pay attention to dynamic virtualizationmovements that make moving boundary targets harder to monitor.SIEM Best Practice #7 – Monitoring and reporting requirementsEstablish key monitoring and reporting requirements includingobjectives, targets, capacity requirements, compliance reports,implementation and workflow with key constituents prior todeployment of any technical tools. It is important to take a phasedapproach to achieve success – an “All At Once” approach willusually falter due to the human factors involving organizational (andindividual) education, changing requirements and accountability.SIEM Best Practice #3 – Access controlsConsolidate Authentication, Authorization and Accounting (AAA)mechanisms to control appropriate access to resources. Use SIEMrules, alerts and reports to bring together all AAA – successfullogins, subsequent secondary logins and user/system activitiesto facilitate investigations. Track and resolve the “true identity”behind shared credentials. Make sure to put incident response andreport review procedures in place prior to activating SIEM rulesand reports. Monitor failures in addition to successful accesses tomonitor and investigate insider threats including privileged usersand consultants.SIEM Best Practice #4 – Acceptable Use Monitoring (AUP)Publish policies for users to understand when, where and how bestto use and protect corporate assets and information. Develop watchlists to facilitate monitoring processes for AUP for critical resources,user roles and specific AUP violation scenarios that align to thosepolicies. Extend activity monitoring beyond normal businesshours with special focus on critical assets or anomalous behavior.Obtain appropriate legal advice to assure that potential liabilityfor monitoring user activity is understood and addressed. By nothaving accurate records with regards to the scope of an incident, theresulting financial penalties and reputation risks can be significant.SIEM Best Practice #8 – Deployment and infrastructure activationManage the deployment in phases, maintain source activation andconsistent delivery of event and log data and refine the systemcontinuously. On-going maintenance costs and growth plans needto be incorporated as part of the overall planning to obtain a trueTotal Cost of Ownership (TCO). Lack of documented procedures toensure appropriate activation and access to event log data will leadto monitoring and audit gaps.SIEM Best Practice #9 – Network and host defensesAggregate IDS/IPS alerting, conduct event consolidation onlike alerts, filter IDS/IPS false positives and facilitate incidentmanagement. Integrate incident management / case managementtools and generate test traffic to test SIEM integration with IDS andincident response processes. It is important to detect false positivealerts such as the detection of benign attacks or malicious activitiesby an IDS/IPS that otherwise require security staff to respond.SIEM Best Practice #10 – Network and system resource integrityUnderstanding the infrastructure, from deployed devices, systems,applications to configuration, vulnerability and patch details isrequired to assure and maintain operating integrity. For resourceintegrity, it is necessary to understand the complete context ofwho, what, when, why and where information with regards to anapproved, unauthorized or undocumented change.SIEM Best Practice #5 – Application defensesApplication defenses is required beyond the perimeter, networkand host security defenses need to include application platformmonitoring, resource monitoring, web application defenses anddatabase activity monitoring. Incorporate web application firewalls(WAF) to inspect and filter HTTP traffic at the application layer tomonitor web and mobile applications. Database logging can beproblematic with regards to database performance and databaseaudit table overwrites. The use of shared administrative credentialsis another pitfall to watch for.3

1Malware controlSubject CoverageMonitor and report on key status, threats, issues, violations andTracking of virus, malware, spyware,activity supporting malware controls.spam, malicious website request,Overview and Highlight ProcessesOne of the more popular end point security tools is anti- virus. However, malware controlis not limited to the use of anti- virus tools, but extends to managing additional threats,unusual resource activity, as well asdetection, quarantine and remediation.RecommendedSample Metricsinfections, scope of infection, outages and breaches related to a variety of malware risks and Top reported malware threatsactivity. Malware controls would comprise of identifying, mitigating and measuring: viruses, Anti- virus trends; prevented, detected,root kits, trojans and spyware issues, botnet, peer- 2- peer activity, spam, and suspiciouswebsite and email communications.The majority of information security compliance frameworks specify employing anti- malwaretools. Best practices dictate that anti- malware implementation should be tiered from endpoint to perimeter (e.g. client, server and gateway). Processes should be established withremediated Spam trends; identified and removed Top malware attacked sources, and byprior vulnerability issuesregard to ensuring activation and standard use, monitoring and reviewing malware activity, Top unusual traffic to and from sourcesand most importantly, responding to issues. This would include monitoring various anti- Top source and destinations of maliciousmalware solutions for updates and failures. Procedures with regards to malware includemanagement, incident response, infection or breach documentation, issue notification,quarantine of infected systems, and remediation.Organizations should routinely monitor for critical anti- virus/malware issues; prioritized bysystem, type of issue, effect on operations, or the scope/probable spread of infection. SIEMsoffer the means to centralize malware monitoring and reporting processing, measuringon overall malware infection, and assessing operational impact. One method to facilitateconnections Top systems with multiple infections / topsystems re- infected Top systems with suspicious malwareactivity Anomalous network activitymonitoring is to correlate event log data from anti- malware management systems rather than Atypical email or web communicationsend point devices themselves. Keeping track of resolved infections or problems also helps Anti- virus stop, start, update failuresjustify security expenditures. For example, SIEMs can report spam and viruses prevented ormitigated at the MTA gateway.SIEMs also provide the means to centralize malware incident response. One usefulmonitoring practice is to enable SIEMs to allow operators to focus on detection- only (ratherthan remediated) malware issues, as well as identifying difficult malware threats. SomeSIEMs have the means to assimilate network flow data and establish baselines or profiles oftraffic activity. Having this broader context allows the SIEM to identify suspicious applicationactivity and network traffic bursts, such as identifying symptoms and direct activity relatedTechnology Considerations Sources will include all anti- malwareapplications; anti- virus, anti- trojan,spam filtering, web filtering and websitescanners For greater SIEM context, additionalto botnets and worms. SIEMS can also facilitate processes to identify infected systemssources include DNS, IDS, VA andto quarantine and remediate, by correlating: unusual DNS requests, unusual port activitynetwork flow operational datafrom the firewall log, unusual traffic spikes via network flow data, identified port scanningand outbound traffic attributed to zombies, or warnings from the IDS/IPS on outbound Leveraging the anti- malware manager,versus clients, as reporting sourcescommunications to a known malicious site.4