Generating ROI with SIEM Solutions

In today's tightly regulated and interconnected world, it's very useful to have ways to shield yourself (perhaps even benefit) from the cost of complying with regulations and making sure security incidents are, to the best of your ability, prevented.

Logs and security event information are key areas to leverage if you want to stay ahead of other businesses in your area. The sheer volume of logs and event data collected from all sorts of devices has increased sharply over the years, due mostly to decreased costs in hardware (hard disks and memory, basically).

SIEMs have, for the last years, been the preferred way of keeping track of such information in the workplace, but it's not always easy to justify investing in such products when the benefits are not so tangible.

We (IT Management) are generating as much, if not more, data within our enterprise than our actual business units are.

Here are some of the quantifiable benefits of installing a SIEM solution at your organization.

Regulation Compliance

SIEM solutions may be the most cost-effective ways to comply to regulations and they can protect you from fines and/or lawsuits.

Increasing Efficiency/Slashing Downtime

SIEMs can, in addition to their obvious security value, help you visualize infrastructure bottlenecks and points of concern, due to the way they make information available to you.

This can even impact other business areas that, in one way or another, could make use of data that is shown on SIEMs for security purposes only, such as marketing, development and senior management.

More Effective (Centralized) Log Storage and Visualization

Easier and cheaper to train staff (from different backgrounds - compliance, development, system administration and so on), since they will all be using a single system - a single interface - for log viewing, troubleshooting and forensic analysis.

Adding a Layer Between Viewing Logs and Having Access to the Machines where these Logs are Generated

You could use a SIEM solution to allow people to view (and even analyse) logs while not letting them having root and/or admin access to the underlying infrastructure.

Identifying Hitherto Unknown Usage Patterns

SIEM systems can be used for general data exploration. This is particularly the case when users do not know what they are looking for.

Users do not always know what they are looking for.

If the system provides easy-to-use data visualization and manipulation facilities (charts, graphs and tables), users can find out novel ways to derive value from SIEM solutions - ways the original designers never envisioned.

Generating Reports

With all logged data (from across your whole IT infrastructure) neatly organized and classified (this being one of the main attributes of a good SIEM solution), it is just a matter of creating a simple script to harness that data and produce an executive summary with graphs and explanations to help senior management make clear decisions.

References

BrightTalk Webinar: Using SIEM/Log Management to Achieve Significant ROI (Might require free Registration)