Risk and Security Rewards
There’s no reward without risk, according to the old saying. But in the current, closely-regulated business environment, the demand is for reward with near-zero risk. So it’s no surprise that risk control groups (RCGs) are a powerful voice in any financial organisation, reacting to change in the risk landscape with recommendations for both corporate policy and IT.
The remit of RCGs goes beyond traditional information security to embrace wider business, partnership and cultural considerations. They don’t view risk as a simple, binary issue of ‘are we secure or not?’ but instead pose the constant questions: ‘What’s our current exposure to risk? What could we stand to lose?’
It is these questions that can put a company’s RCG and corporate IT team at cross purposes. The two camps may have very different views and understanding of what exactly should be secured – and in turn, very different approaches to managing what they see as the actual security risks.
Often, information security implementations are driven by the corporate IT team. This may focus on solutions addressing the latest emerging threats, including malware, hacking attempts and so on. But simply adding point security products to the network may not enhance overall security.
Unless an in-depth business risk analysis is done, there is the chance of overlooking areas that really do need protection, while over-protecting others. And crucially, unless the business has an effective method for monitoring, in real time, its true overall security stance, its current vulnerabilities and risk points, it cannot effectively manage risk, or deliver truly effective protection to the business’s IT assets.
Yet this is a position that many companies are in. Despite their considerable investments in advanced point security products, IT teams cannot manage the security of the corporate network easily. They are constantly on high alert from the constant stream of events being reported by every product’s management console.
This stream of events and alerts – Gartner estimates that the systems in companies with 1000+ users generate over 200 security ‘events’ per second – is enough to overwhelm any IT department. Worse, it masks what’s really happening on the network and stops the IT team, and any other parties, being able to manage risks strategically. So the IT team can’t say for sure what the security status is on the network. Which means the RCG can’t easily report on the true status of the potential risks to the core business systems, data and processes that the IT security infrastructure is supposed to protect.
So how do businesses reconcile both the security management needs of the IT team and the risk management needs of the RCG – and of the business as a whole? This is where security information and event management (SIEM) comes in.
For IT teams, an SIEM solution adds value to their existing multiple security products and corporate systems. It integrates the jumble of different management consoles and reporting formats to simplify control, give better visibility and improve response times. It does this by drastically reducing the level of data and log traffic generated by multiple systems – giving IT staff a less cluttered view of what’s happening across their networks.
These data and event logs are aggregated into one central, correlating SIEM engine. This engine establishes the relationships between the logs and alarms produced by a company’s various core business systems, such as ERP, transaction management and so on, and security devices, and correlates it. SIEM will typically filter the number of events and alerts down by a factor of 1000 or more. Also, it can overlay multiple reporting logs and data streams to give IT staff a single-console view of critical security events.
This view helps identify irregular activities or attempted attacks that would otherwise be invisible without correlation. And it’s important to remember that this view is built around the behaviour of core business systems, not just security products.
SIEM can also put alerts into context, by linking to internal and external resources which document known vulnerabilities and exploits – and with an embedded incident handling and resolution system, assist IT staff in delivering the most effective response to events.
An additional feature is the ability for IT staff to set up and enforce better security policies, and make changes to those policies and products on-the-fly from the SIEM console, if any attack or threat is suspected or identified. This enables a complete plan-do-check-act cycle in accordance with best practice in security management.
So SIEM serves the needs of the IT team. What about the RCG, and the company’s overall risk stance? Because SIEM solutions extend from the core of the business outward, they can log and report on any changes to core assets, wherever those assets are stored. This makes SIEM a central storage, reporting and audit engine across the company’s entire IT infrastructure, providing a single, large-scale body of security evidence. This enables easy tracking of security processes, and detailed analysis of those processes by any party that needs to do so.
Using the SIEM solution, the RCG can undertake risk analyses, identifying and quantifying the impact on the business of any security breaches, assessing threat levels and deciding what next steps are justified.