The Fundamental Difference Between SIEM & Log Management Solutions: State vs. Event Data

(1)

An EiQ Networks White Paper

The Fundamental

Difference Between SIEM &

Log Management Solutions:

(2)

The Fundamental Difference Between

SIEM & Log Management Solutions:

State vs. Event Data

Confused by all of the security technologies available today? Well, you’re not alone. Sometimes it feels like there are more acronyms than problems to be solved, but the end result of a secure and compliant environment is the primary driver. Two specific technologies rise to the top when it comes to visibility: Security Information and Event Management (SIEM) and Log Management. These technologies provide the critical visibility into what is going on in your network. What’s the difference between all the SIEM & Log Management solutions in the market? It’s simple. It comes down to data types; more specifically, understanding the different types of data that each solution is collecting from the systems being monitored.

In general terms, you can classify the data a solution collects into two distinct categories: 1) data that describes an event or

2) data that describes the state of a system on the network.

What is Event Data?

Event data is data that describes something that occurred on the network. Network systems are configured to keep track of activities in the form of log events. For example, anytime someone logs in to the domain, a record of that event is stored. Included in that record are the specifics of that event such as the source IP address, destination IP, user ID, event description, event ID, message, and result. Failed login events are stored along with hundreds of other event types. What every SIEM/Log Management solution does is capture all the event data from the hundreds of different devices and applications on your network. As a potential acquirer of SIEM/Log Management solution, it’s critical that you understand all such solutions collect event data.

What’s the Difference?

(3)

What is State Data?

State data is data that describes the state of an event. That state of a system defines how it’s configured, the applications installed on the system, the users, shares, processes, running configuration, registry setting, ACLs, vulnerabilities, etc. By knowing key specifics about your assets, you are now able to understand the full state of a system.

If we go back and look at an event, say the login attempt described earlier, the only thing we know is the details surrounding the event. We don’t know anything about the device where the event originated because the state of the system (or systems in question) is not contained within the event.

Why is State Data Important?

For years we’ve been taught the importance of collecting and reviewing audit log data. It’s been engrained in our thinking through regulations such as 800-53, 8500.2, PCI, ISO 17799, SANS Critical Controls, etc. because in order to stop attacks you need to be aware of what’s going on in your environment. However, while reviewing event data is certainly important, you need to ask whether, “ just reviewing system events provides you with the level of security you desire.” More than likely the answer no. While there is no silver bullet to security, it’s always important to understand how to gain greater cyber awareness. Combining the review of state data with event data takes us to the next level in this regard. By

analyzing state data, it puts a significant amount of context around the events that are occurring. For example, a series

of failed logon attempts on a server followed by a successful logon becomes more significant if that successful logon is followed by a change in the state of that server.

What Else?

We’ve explored the importance of introducing state data into our analysis in an effort to provide greater context around all the thousands of events being generated each day. But there is another benefit of collecting state data. The collection and subsequent processing of state data can help organizations understand whether the systems on the network are configured in accordance with predefined standards such as DISA STIGs, USGCBs, or CIS policies. The key word in this statement is CAN. Why? Because two things must occur in order to determine whether a device is configured appropriately. First, the state of the system must be collected. Second, and this is a big step, the data that describes the state of a system must be transformed into compliance information. Sounds easy enough right? Not quite. Take a DISA STIG for Windows 2008 R2 Server. On any given day, a server administrator could leverage a number of tools such as MS SCOM or SCCM to view the full configuration of that system. Such tools, for example, will tell you the account lockout duration of a system, patches applied, services running, and so forth. What’s generally not known is whether the account lockout duration of that system meets the standards set fourth in the DISA STIG. Something must be able to translate that configuration data into compliance data in order to determine this. This translation is what we refer to as the “last mile of compliance.” Lots of tools can provide state data that describes the configuration of a system, but few can actually translate that configuration data into meaningful compliance data.

(4)

What Have We Learned?

So far we have covered the following:

• All SIEM and Log Management solutions look at event data. • Event data is data that describes something that occurred, such as a logon attempt. • State data is data that describes the full state of a system and includes, but is not limited to, registry settings, patches installed, users, system running configuration, ACLs, etc. • To gain greater cyber intelligence, it’s helpful to incorporate state data into your analysis to provide greater context to the events that are occurring. • State data can be leveraged to provide compliance information so long as the state of the systems is being collected and then translated into compliance information.

Ask the Right Questions

So getting back to the original question. You’ve got a requirement to implement a SIEM/Log Management tool and you’ve got about 50 different solutions from which to choose, how do you differentiate one from another? How can you narrow down the field to a manageable list? You could put together a laundry list of requirements together and then evaluate each solution against those requirements and do some research to help narrow the list down. What you’ll end up finding is that most of them will meet the core SIEM Log Management requirements out of the gate. Of course there are going to be some differences among all the solutions, but unless you are asking the right questions, the differences won’t be fundamental or groundbreaking.

Rather than going through hours of painstaking research and a dozen or so vendor briefs, start with a single

easy-to-answer question: “What type of data does your solution collect from the devices on the network?” A straight answer, will sound something like this, “Our product collects the configuration, performance, vulnerability, and flow data from (Windows systems, network devices, etc.). Or if you want to be more direct, ask: “Can your solution tell me the full configuration of a system it is monitoring?” If the answers is yes, then set up a demo so they can show you that their solution can in fact collect a system’s state data. By asking this simple question, you will automatically narrow down your potential list of solutions to a very small subset.

(5)

What about SecureVue?

SecureVue from EiQ Networks collects both state and event data from the systems on your network. SecureVue will retrieve a system’s security and audit event data plus its configuration, a list of assets that make up that system (software installed, users, patches, services), the performance of the system, system flow data, and vulnerability data. With that, SecureVue goes well beyond just analyzing event data. It incorporates state data into the analysis to provide much greater context around the events that are occurring.

Not only is the state data correlated with event data to provide greater cyber awareness, it is also repurposed to provide other capabilities not available with any other SIEM or Log Management solution. More specifically, SecureVue is a combined solution that meets two critical information assurance/cyber security requirements:

1. Audit Log Management & SIEM 2. Continuous DISA STIG Monitoring

The ability to provide both of these two key capabilities in a single product helps explain the reason for SecureVue’s popularity within the US Department of Defense.

What’s the Foundation of SecureVue?

That’s not the case. Everything described in this paper can be accomplished without the need to deploy an agent. An agentless approach is important because it allows SecureVue to monitor systems for which agents can’t be deployed, such as network devices. SecureVue does have an optional agent, but deploying the agent is the exception, not the norm.

Without the agent, SecureVue will leverage protocols that exist in your network today. The protocol SecureVue will use to collect the data depends on A) the type of data being collected and B) the device from which it is collecting data. SecureVue will leverage both push and pull collections. In other words, SecureVue can collect some data passively such as syslog data or flow data, while other data requires an active pull. How SecureVue collects data and the protocols used are all done behind the scenes. You as an administrator only need to know what data you want to collect from which systems (or group of systems).

SecureVue will also leverage technology you have already deployed in your network to collect critical cyber security/ information assurance data. These third party systems include you vulnerability scanners, anti virus solutions, and proxy/content filtering solutions to name a few.

(6)

Log Management & SIEM Capability Description

SecureVue® Log Management & SIEM provides industry-leading event and log collection, storage, correlation, reporting, and search functions for meeting all DoDI 8500.2 and NIST 800-53 Audit Log Management requirements. The solution supports a broad range of event sources, including network infrastructure, security solutions, operating systems, and applications.

Automated Event Review

One of the key requirements pertaining to audit log management contained within NIST 800-53 and DoDI 8500.2 is the need to “review” events for suspicious activity. The challenge with this requirement is to go through the thousands of events that are generated daily to identify the ones that are “suspicious” or worthy of further inspection. This is one of the areas where SecureVue shines. Once SecureVue is collecting event data, it can automatically correlate and filter events and notify individuals which ones, if any, are considered suspicious or require further investigation. This automated method removes the need to manually review events and saves a tremendous amount of time. SecureVue comes with 600+ alerts and many that are tailored specifically to DoD and federal agencies. These alerts can be easily tailored via a GUI to meet any specific requirements you may have. Out of the box alerts include notifications when the following events occur:

• 10 failed login attempts on a device from a single IP within a five-minute period • Traffic that violates ports and protocols policies • System are connected to network with missing required software (such as Host-Based IPS, Anti-Virus) or systems with banned software (Peer-to-peer) • DNS queries from organization that query non organization DNS servers • Large data transfers to the Internet • Long outbound connections • Inbound traffic to Web servers not using TCP 80/443 • Multiple denies at the firewall followed by an allow (Single source IP address) • SQL anomalies: the xp cmdshell being enabled followed by user accounts added to local systems • CPU Usage, Memory Usage, and low disk space • Profiling service accounts • Accounts added to local groups on servers

(7)

Flexible Dashboard

SecureVue comes with 50+ dashboards out of the box that allow users to easily visualize the risk and operational picture of the network. Any dashboard can easily be tailored to meet specific requirements or user preferences, saved, and shared with others.

Dashboards can incorporate controls for both event and state data sets and are interactive so users can drill-down on them to get into greater details.

Forensic Searching

Utilize ForensicVue®, an integrated component of SecureVue, to significantly decrease the time required to discover and visualize the root cause of security incidents. Organizations can use ForensicVue in almost the same manner as a search engine: getting answers to specific questions. For example, using ForensicVue, you can quickly see:

• All login events using between 12:10 and 12:15 AM

• The results could be easily narrowed to search within those results for those login attempts using the user ID administrator

What makes SecureVue even more powerful is the fact that searches can be conducted to go beyond event data and search within device state data. For example, you may want to run a search to show what systems are missing a particular patch or which systems have “Wireshark” installed.

(8)

Easy Setup and Manage

The fact that SecureVue does not require an agent makes the setup and ongoing management much easier. SecureVue can begin monitoring hundreds of devices in hours.

What also makes SecureVue much easier to manage is the fact that it does not utilize a relational database management system. This is important because many log management and SIEM systems require an RDBMS, which requires system administrators who know and understand these complex databases. With such systems, one needs to understand how to increase table space sizes, run import and export commands, create new indexes, and optimize the database. These are all DBA activities that may require training and certification in Oracle, MSSQL, or Sybase. With SecureVue, the database is a highly efficient, flat-file system, which means if you know how to use Windows Explorer, you know how to manage the SecureVue database.

DISA STIG & USGCB Monitoring Capability Description

SecureVue’s ability to monitor system state for asset and configuration changes makes it uniquely qualified to report compliance with industry configuration standards including DISA STIG, CIS, and USGCB.

(9)

Key Benefits

Save Time with Automated Checks

SecureVue is saving organizations thousands of hours each year through automated checks.

Continuous View of Compliance vs. Point in Time

With SecureVue, users can now see compliance on a continuous basis. In the past, users relied on a point-and-shoot approach. In order to know compliance, they had to conduct a manual inspection of system.

Flexible Dashboards

SecureVue offers dozens of out of the box dashboards to display compliance data across the entire enterprise. New dashboards can be created in a matter of minutes through the simple point and click dashboard editor.

Extensive Reporting

Dozens of reports are available; all can be exported in various formats including PDF and CSV and can provide summary data such as overall level of compliance or compliance percentage over time. Detailed reports can provide the specifics about each control for each device checked (Host name, control name, control ID, severity, and status).

Compliance Alerts

SecureVue can be configured to notify selected individuals or groups regarding non-compliance, a change in compliance, or compliance that drops below a certain level. These alerts can be sent through an email, trouble ticket, or trap.

Custom Baselines

There is no problem if you want to use SecureVue to track compliance against a custom baseline. With a few mouse-clicks, SecureVue can collect the configuration of a “gold-standard” device. That “gold-standard” can be used to compare the compliance of all like devices.

SCAP and Beyond

SecureVue has received its FDCC and Authenticated Configuration SCAP validations. What’s important to note, however, is that SecureVue goes well beyond most SCAP-certified scanners, which are limited in they can only validate devices against compliance standards if there is SCAP content. If there is no SCAP content available, such as the case with the DISA STIGs for network devices and databases, SCAP-dependent scanners will do nothing to automate the checks. To support the overall mission of automated and continuous compliance, EiQ has developed downloadable content for STIG checks and CIS policies when there is no SCAP content, but demand exists for automated checks. See our list of supported policies here.

Exception Reporting

It is typically impossible for organizations to adhere 100% to any configuration standard. That is why SecureVue offers flexible exception tracking and reporting. For example, if you know there are certain controls that you will not be able to meet because it will break an application or system, an exception can be created within SecureVue for that control. That exception can be applied to a single system, multiple systems, or a group of systems. With this exception in place, compliance results will calculate this within the overall compliance results. In addition, a report can be easily generated to list all of the exceptions, the exception expiration date, and to what devices that exception applies.

(10)

SecureVue for Auditors

In those situations where auditors need tools to help automate compliance checks, SecureVue is available as an auditors license. Contact an EiQ representative for more information.

Configuration Monitoring Capability Description

Information Assurance requirements outlined in 800-53, 8500.2, and AR 25-2 require agencies and military installations to implement a broad set of people, processes and technologies to help protect government networks. Historically, the technology requirements meant the implementation of several point tools to meet the various requirements. SecureVue collects a broad array of data elements and as a result, can meet several of the IA requirements without the need to acquire multiple tools. SecureVue can meet requirements related to compliance management, configuration auditing, and audit log management within a single tool.

Key 8500.2 Requirements Addressed by SecureVue.

http://www.cac.mil/docs/DoDD-8500.2.pdf

Requirement Description How SecureVue Addresses

DCPP-1 Ports, Protocols, and Services

SecureVue can provide notifications to information assurance manager when a device violates ports and protocols policies.

DCCS-2, DCCS-1 Configuration Specifications

SecureVue will automatically and continuously monitor devices against predefined configuration specifications including DISA STIGs, and CIS Standards.

DCSW-1 SW Baseline SecureVue provides rich software inventory information data including list of applications installed, services running, patches missing/applied, etc. ECAT-2, ECAT-1 Audit Trail,

Monitoring, Analysis and Reporting

SecureVue collects audit log data from all networked devices and correlates data to notify administrators of suspicious activity ECRG-1 Audit Reduction and

Report Generation

SecureVue provides alerts, reports, and forensic log searching mechanisms to help review audit log records quickly and easily. ECSC-1 Security

Configuration Compliance

SecureVue provides continuous monitoring of device configurations against the DISA STIGs

ECTP-1 Audit Trail Protection

SecureVue protects audit events against unauthorized access,

modification, and deletion by utilizing AES encryption in back end data stores and ensuring that data cannot be accessed outside of SecureVue. Supporting 8500.2 Requirements Addressed by SecureVue

(11)

DCPR-1 CM Process SecureVue can provide verification that any proposed changes during the CM process was applied as intended.

ECVP-1 Host Based IPS SecureVue can notify administrators of devices without a Host-Based IPS installed or running.

ECVP-1 Virus Protection SecureVue can notify administrators of devices without an Anti-Virus solution installed or running.

PESL-1 Screen Lock SecureVue can notify administrators if a device is not configured to automatically lock after a certain period of inactivity.

Key requirements addressed by SecureVue in 8500.2 include those related to the following sections: Key 800-53 Requirements Addressed by SecureVue

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf

AC-2 Automated Audit Actions

SecureVue can provide automated notifications to administrators upon the creation, modification, enabling, disabling, or removal of accounts. AC-2 Account Monitoring/

Atypical Usage

SecureVue reports atypical usage of information system accounts to organization-defined personnel or roles.

AC-3 Role-Based Access Control

SecureVue supports role-based access control to all features and data collected or utilized.

AC-7 Unsuccessful Logon Attempts

SecureVue can monitor and alert of unsuccessful logon attempts throughout the environment.

AC-10 Concurrent Session Control

SecureVue can be configured to limit the maximum number of users allowed as well as concurrent connections per user.

AU-2 Audit Events – Reviews and Updates

SecureVue allows administrators to easily audit events

AU-3 Content of Audit Records

SecureVue will collect audit event data from a wide variety of networked devices. Data in audit events contains but not limited to: event type, time of event, location of event, source of event, outcome of event, and identify of individuals associated with event.

AU-4 Audit Storage Capacity

SecureVue has built in compression of 18:1 minimizing the amount of storage required to retain audit events.

AU-5 Response to Audit Processing Failures

SecureVue has built in administrative alerts that provide automated notifications in the event of an audit processing failure which include alerts when allocated audit record storage volume reaches organization-defined percentage of repository maximum audit record storage capacity.

(12)

AU-6 Audit Review Analysis and Reporting

SecureVue provides an automated way to conduct audit event review, analysis, and reporting.

AU-6 Correlate Audit Responses

SecureVue correlates audit event data across multiple data silos to help identify suspicious activity and provide greater situational awareness. AU-6 Central Review and

Analysis

SecureVue provides a central repository for the review of all audit event data across the enterprise.

AU-6 Integration/ Scanning and Monitoring Capabilities

SecureVue integrates with various enterprise capabilities such as vulnerability scanners for correlation against audit event data to further enhance the ability to identify inappropriate or unusual activity.

AU-7 Audit Reduction and Report Generation

SecureVue provides on-demand audit review through its web enabled ForensicVue forensic search engine. This allows users to search through millions of events in seconds using an easy to navigate web interface. This capability eases after-the-fact investigations of security incidents. SecureVue also comes with hundreds of out of the box alerts to meet all reporting requirements associated with this section.

AU-9 Protection of Audit Information

SecureVue protects audit events against unauthorized access,

modification, and deletion by utilizing AES encryption in back end data stores and ensuring that data cannot be accessed outside of SecureVue. AU-11 Audit Record

Retention

SecureVue can utilize local storage, network attached storage, or storage area networks. This enables SecureVue to meet all federal government audit retention requirements.

AU-12 Audit Generation SecureVue can generate audit information from any data received by reports, alerts or ad hoc searched.

CA-7 Continuous Monitoring

SecureVue continuously monitors systems against configuration standards as prescribed by DoD and DHS

CA-9 Internal System Connections - Security

Compliance Checks

SecureVue can be leveraged to ensure connecting systems are configured as prescribed by DISA STIGs or USGCBs.

CM-2 Baseline Configuration

SecureVue provides an automated mechanism for comparing information systems against custom baselines on industry standards such as DISA STIGs. SecureVue allows for administrators to easily see how systems deviate from baselines and retain previous baselines for comparison

(13)

CM-3 Configuration Change Control

SecureVue can be leveraged to validate if proposed changes were

successfully applied to systems. SecureVue can also be leveraged to notify administrators if changes were made to systems outside of the change window. SecureVue can also provide alerts to notify individuals if systems were changed outside of the prescribed baseline.

CM-6 Configuration Settings

SecureVue will identify “any deviations from established configuration settings for organization-defined information system components based on organizational-defined operational requirements;” and “monitors changes to the configuration settings in accordance with organizational policies and procedures.”

CM-8 Information System Component Inventory

SecureVue provides “an inventory of information system components” to include hardware, applications installed (version), services, users, shares, patches, vulnerabilities, etc. Using this inventory, SecureVue can then notify administrators of the presence of unauthorized software. CM-11 User Installed

Software

SecureVue “alerts organization-defined personnel or roles when the unauthorized installation of software is detected.”

IR-4 Incident Handling SecureVue will assist in the detection of security incidents and automate creation of tickets based upon a series of detected events.

IR-5 Incident Monitoring SecureVue provides a workflow to assist in tracking and documenting security incidents.

IR-6 Incident Reporting SecureVue provides automated mechanisms to assist in the reporting of security incidents.

RA-5 Vulnerability Scanning – Review Historic Audit Logs

SecureVue can be leveraged to easily:

• Determine if the organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited. • Correlate the output from vulnerability scanning tools to determine the

presence of multi-vulnerability/multi-hop attack vectors.

SI-4 Information System Monitoring

SecureVue can be configured to detect attack indicators and correlate information from various detection sources, providing a greater situational awareness picture.

About EiQ Networks

EiQ Networks, a pioneer in security hybrid SaaS and continuous security intelligence solutions and services, is transforming how organizations identify threats, mitigate risks, and enable compliance. EiQ offers SOCVue, a security hybrid SaaS offering, and provides 24x7 security operations to Small to Medium enterprises who need to protect themselves against cyber attacks but lack resources or on-staff expertise to implement an effective security program. SecureVue®, a continuous security intelligence platform, helps organizations proactively detect incidents, implement security best practices, and receive timely and actionable intelligence along with remediation guidance. Through a single console, SecureVue enables a unified view of an organization’s entire IT infrastructure for continuous security monitoring, critical security control assessment, configuration auditing, and compliance automation. For more information,