-: SIEM in this lesson, 2 2
we're going to discuss a security technology known as a SIEM, 3 3
or security information and event management system. 4 4
Now a SIEM is a security solution that provides real time 5 5
or near real-time analysis of security alerts 6 6
that are generated by network hardware and applications. 7 7
In our networks, we have a lot of different devices, 8 8
including not just our network infrastructure, 9 9
but also all our client devices that we host on the network 10 10
as well, to maintain a strong security posture, 11 11
it is critical to understand the status 12 12
of each of these devices by reviewing their logs, 13 13
informational alerts and events. 14 14
But if we had to log into each of these machines 15 15
individually to collect and analyze all that data, 16 16
it would take us forever. 17 17
Luckily, we have a solution known as a SIEM, 18 18
that helps us overcome this challenge. 19 19
A SIEM is able to gather logs and data 20 20
from all sorts of different systems 21 21
and combine them into a single combined data store. 22 22
This allows our cybersecurity analysts, 23 23
system administers and network administrators 24 24
to review the logs and find abnormalities 25 25
or things that are not operating within our baselines. 26 26
When it comes to reviewing these logs, 27 27
it shouldn't be done only after an incident 28 28
or after breaches occurred. 29 29
Instead conducting law reviews should be something 30 30
that's done regularly and routinely 31 31
as part of your network administration 32 32
and system management functions. 33 33
To effectively conduct a log review and analysis though, 34 34
you really do need to utilize a SIEM. 35 35
A seam is used to help us correlate the events 36 36
between different systems across the network. 37 37
Something that we couldn't do ourselves easily 38 38
if we're looking at logs from each individual machine. 39 39
Now by using a SIEM, we can combine 40 40
five essential functions that provides us 41 41
with a more comprehensive view of our enterprise network. 42 42
This is done by performing log collection, 43 43
normalization, correlation, aggregation and reporting. 44 44
Now, first we have log collection. 45 45
Log collection of all of our event records 46 46
from sources throughout the network is going to happen 47 47
usually using something like Syslog. 48 48
This will provide us with important forensic tools 49 49
and help us address 50 50
compliance reporting requirements as well. 51 51
Second, we have normalization. 52 52
Normalization is going to map log messages 53 53
from different systems into a common data model. 54 54
This will enable us to be able to connect 55 55
and analyze related events, 56 56
even if they're initially logged 57 57
in different source formats. 58 58
Third, we have correlation. 59 59
Correlation is going to link the logs and events 60 60
from different systems or applications 61 61
into a single data feed, 62 62
which speeds up our detection of threats, 63 63
as well as decreases the time for us 64 64
to be able to respond to those threats. 65 65
Fourth, we have aggregation. 66 66
Aggregation is going to reduce the volume of event data 67 67
by consolidating duplicate events 68 68
and taking those records and merging them 69 69
into a single record. 70 70
Fifth, we have reporting. 71 71
Reporting is going to be used to present 72 72
the correlated, aggregated event data 73 73
in a real-time monitoring dashboard 74 74
if you're an analyst, and if you're in management, 75 75
you're going to get some form of a longterm summary 76 76
or report at the end, and that's also part of reporting. 77 77
All right, let's consider a simple example. 78 78
You're looking through the logs and you see 79 79
that somebody has logged in over VPN from Asia. 80 80
When you look up the user ID, you see it's John Smith, 81 81
all right, that seems normal. 82 82
Maybe he's in Asia because he's on a business trip. 83 83
Now, while there may be nothing wrong with this, 84 84
a few minutes later, 85 85
you're looking at your SIEM and you see 86 86
that the access control system says 87 87
that John Smith's ID was just used 88 88
to log into the server room inside your building. 89 89
All right, now we have an issue 90 90
because if your server room is sitting in America 91 91
and John Smith is supposedly accessing us 92 92
from a VPN in Asia, something is wrong, 93 93
'cause he can't be both in the server room 94 94
and on a business trip in Asia at the same time. 95 95
So one of these things has to be wrong. 96 96
Now, either of these two events 97 97
by themselves would be totally fine 98 98
and not suspicious at all. 99 99
But by seeing them correlated together 100 100
at the same time or nearly the same time, 101 101
this tells us that there's something wrong here. 102 102
And we need to flag that as suspicious 103 103
and investigate it further. 104 104
Now, as we look into the situation, 105 105
we can determine where this person really is. 106 106
We can just walk down to the server room and say, 107 107
is John here? 108 108
And so he says, no, he's on a business trip in Asia. 109 109
Now we need to go check the security footage 110 110
and see who is logging in with John's credentials 111 111
here in the server room. 112 112
A SIEM allows us to do this type of correlation 113 113
very quickly and very easily, 114 114
and be able to deconflict these things. 115 115
A security information event management system 116 116
or SIEM can be implemented in many different ways. 117 117
A SIEM can exist as a piece of software 118 118
running on a server, a hardware appliance, 119 119
or even as an outsource managed service. 120 120
In order to effectively deploy a SIEM, 121 121
you have to consider a lot of different things. 122 122
First, you need to be able to log 123 123
all the relevant events and filter out anything 124 124
that's considered to be irrelevant data. 125 125
Second, you need to make sure you establish 126 126
and document the scope of the events. 127 127
Exactly what is it that you're going to log? 128 128
What's going to be considered inside or outside of your scope? 129 129
Third, you need to develop use cases to define a threat. 130 130
This will help you to find exactly what you do 131 131
and do not consider a threat and what you may 132 132
want to take action on or postpone for later. 133 133
Forth, you need to plan incident responses 134 134
for given scenarios or events. 135 135
If you know that when you see this type of thing occur, 136 136
then you need to take those types of actions. 137 137
That's what I'm talking about here. 138 138
You need to have these pre-planned responses 139 139
for any given threat that you might face. 140 140
Fifth, we want to establish a ticketing process 141 141
so we can track all these different events that we flag. 142 142
This way, as we go into the SIEM, 143 143
we can see something that looks unusual, 144 144
like my example of somebody logging in from Asia 145 145
and at the local office at the same time. 146 146
And then we can flag it and have it tracked 147 147
through the process to completion, 148 148
to make sure nobody forgets about it. 149 149
Sixth, we want to make sure we schedule regular threat hunting 150 150
by working with our cyber security analysts 151 151
and using our SIEM. 152 152
By doing this, we want to make sure 153 153
we're not missing any important events 154 154
that may have escaped the automated alerts 155 155
that we create inside the system. 156 156
By going through and doing threat hunting, 157 157
our cyber security analysts will be able to catch bad guys 158 158
doing bad things that may have escaped 159 159
our automated alerts and seventh, 160 160
our final consideration is how are we going to provide 161 161
auditors and analysts an evidence trail? 162 162
by using a seam, we have this great centralized repository 163 163
with lots of different data. 164 164
And so it becomes a great place for an auditor 165 165
or analyst to look through as they're doing their analysis 166 166
as part of a compliance-based inspection, as you can see, 167 167
there are a lot of great benefits and considerations 168 168
that we have when we start using a SIEM. 169 169
It's important for us 170 170
to always properly configure our network devices, 171 171
to make sure they're feeding their data into our SIEM 172 172
within the scope of our events. 173 173
Remember, a SIEM is going to take data 174 174
using the Syslog protocol. 175 175
This means we're going to be using UDP port 514, 176 176
or TCP port 1468, as that is being brought into the SIEM, 177 177
it's going to be classified 178 178
based on a log level from zero to seven. 179 179
Zero is our most important or most critical, 180 180
and seven is our least important or most informational, 181 181
just like we had with our regular devices using CIS log. 182 182
For the exam, it's important to understand 183 183
the purpose of a SIEM and that a SIEM relies 184 184
on the Syslog protocol to collect the data 185 185
from all these different network devices 186 186
and client devices on our enterprise network. 187 187
And then we're going to use that to normalize, 188 188
correlate and aggregate that logging data 189 189
into a single repository for further analysis.