{"id":34337,"date":"2019-10-15T14:21:50","date_gmt":"2019-10-15T13:21:50","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/?p=34337"},"modified":"2019-10-15T14:21:53","modified_gmt":"2019-10-15T13:21:53","slug":"siem-the-solution-to-the-public-sectors-security-problem","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/10\/15\/siem-the-solution-to-the-public-sectors-security-problem\/","title":{"rendered":"SIEM: The solution to the public sector\u2019s security problem?"},"content":{"rendered":"\n<p><em>Public sector organisations are heavily targeted due to the rich quantity of data they hold. It\u2019s crucial that citizens can trust their government organisations not to let their personal information fall into the wrong hands. SIEM tools might just be the answer to this. Sascha Giese, Head Geek at SolarWinds, identifies exactly what a SIEM is and how public sector organisations, including governments, can make the right decision when choosing which SIEM tool is right for them.<\/em><\/p>\n\n\n\n<p>Cybersecurity\nis one of the biggest challenges being faced throughout the public sector\ntoday. Keeping the data of the general public safe and\ninaccessible is not only crucial for maintaining the trust of citizens, but\nalso for ensuring critical and sensitive data doesn\u2019t fall into the wrong hands.\nThe task of maintaining and advancing cybersecurity in a public sector\norganisation is complex and while no single tool or technology can solve this\nproblem, Security Information and Event Management (SIEM) software might just\nbe the answer to the biggest dilemmas. <\/p>\n\n\n\n<p><strong>Spelling it\nout<\/strong><\/p>\n\n\n\n<p>So, what is\nSIEM? SIEM tools blend Security Information Management (SIM) with Security\nEvent Management (SEM) capabilities into a single solution, with the intention\nof providing comprehensive threat detection, incident response and compliance\nreporting capabilities. <\/p>\n\n\n\n<p>SIEM tools work\nby collecting data from event logs of most devices in an organisation, from\nservers and firewalls to anti-malware and spam filters. The software then analyses\nthese logs, identifies any anomalous activity and issues an alert \u2013 or, in many\ncases, responds automatically. <\/p>\n\n\n\n<p>Specifically,\nwith SIEM software, an IT professional can quickly identify potentially\nsuspicious activity, learn who has been affected and implement automated\nmechanisms to stop an attack before it affects the organisation. And when the IT organisation in question is part of the public\nsector, protecting central government data from harm means protecting people\nacross the UK.<\/p>\n\n\n\n<p>One\nof the main advantages of SIEM software is how it pulls together data\nconsolidation and centralisation.\nWhen data is coming from multiple places \u2013 for example, from different departments\nof a hospital, or across different sites \u2013 SIEM software consolidates and analyses\nthis data in its entirety; the IT team can then view all the data from a single\ndashboard. A single, unified view can help find trends, spot any unusual activity\nand help establish a proactive (as opposed to a reactive) response.<\/p>\n\n\n\n<p><strong>Making the right\ndecision<\/strong><\/p>\n\n\n\n<p>The range of SIEM\ntools from third-party businesses today is huge, with each offering its own benefits.\nThese tools can provide everything an organisation needs, from big data\nanalytics to centralised forensic visibility to artificial intelligence-driven\nbehaviour analytics. However, it can be a real challenge to choose a tool to best\nfit the organisation\u2019s requirements.<\/p>\n\n\n\n<p>There are multiple\nthings to consider when choosing a SIEM solution. Some are more obvious than\nothers, such as scalability; IT teams understand the importance of investing in\na tool that will grow as the organisation\u2019s needs grow. Cost is also always a\nmajor factor, particularly for the public sector where budgets are typically\nquite restricted.<\/p>\n\n\n\n<p>Other things to\nconsider may be less obvious, but are just as important, such as:<br>\n<br>\n<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Does\nthe SIEM provide enough native support for all relevant log sources? It will be\nintegrating a lot of data from a lot of different sources. Be sure the chosen\ntoolset matches well with the types of devices from which it will be collecting\nand analysing information.<\/li><li>If\nthe SIEM doesn\u2019t have native support for a relevant log source, how quickly and\neasily can it be created, and can it support custom log sources for\napplications developed in the organisation? Government IT\nteams will often have to develop bespoke applications to handle their unique\nactivities, so choose a tool that can easily be extended to support new data\nsources as needed.<\/li><li>How\nwell, and quickly, can the SIEM tool analyse data? The quicker the IT security\nteam can identify and contain threats, the more secure the organisation and its\ndata. Reducing the time to detection (TTD) is critical to prevent exposure,\ndata loss, and compromise. Choose a SIEM tool with the\nability to provide advanced analysis quickly, with little security team\nintervention to free up their time for other tasks.<\/li><li>Does\nthe SIEM include useful, relevant, easy-to-use out-of-the-box reports? The\nvalue in the visibility provided through SIEM software is the ability to see\none report or one chart encompassing a vast amount of data. Be sure the organisation\u2019s\nchosen tool provides templates that can be easily implemented and just as\neasily customised where necessary. The quicker the tool is up and running, the\nquicker security threats can be identified and thwarted.<\/li><li>Does\nthe SIEM make it easy to explore the log data and generate custom reports from\nthis? Out-of-the-box reports are always useful, but sometimes questions are\nasked requiring teams to dig a little deeper and create a more customised view\nto show senior management. Choose a tool that simplifies the data exploration\nand reporting function to help you get answers quickly and with minimal effort.<\/li><\/ul>\n\n\n\n<p><br>\nAt the end of the day, government cybersecurity is\nnever going to be an easy fix. It\u2019s becoming one of the most important\naspects of an IT department\u2019s remit, if it isn\u2019t already and so it\u2019s key to understand\nand implement the right solutions to support these employees where they need it\nmost. Cybercriminals are getting smarter and finding more and more creative\nways to infiltrate computer systems and networks. In the public sector \u2013 where\nfunding for new and innovative technologies isn\u2019t always readily available \u2013 IT\nleaders should prioritise the tools that will provide the most value and will\ndeliver the most effective performance across the organisation. <\/p>\n\n\n\n<p>With\nits ability to identify, alert and even resolve security issues faster than a\nhuman employee, a SIEM tool might just be what prevents the next WannaCry\ndisaster.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Public sector organisations are heavily targeted due to the rich quantity of data they hold. It\u2019s crucial that citizens can trust their government organisations not to let their personal information fall into the wrong hands. SIEM tools might just be the answer to this. Sascha Giese, Head Geek at SolarWinds, identifies exactly what a SIEM [&hellip;]<\/p>\n","protected":false},"author":28,"featured_media":34340,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[57,497,86,93],"tags":[6578,13595,4858],"class_list":["post-34337","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-government","category-healthcare","category-top-stories","tag-it","tag-security-information-management","tag-siem"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/34337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=34337"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/34337\/revisions"}],"predecessor-version":[{"id":34339,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/34337\/revisions\/34339"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/34340"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=34337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=34337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=34337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}