Maintaining a safe digital framework can be a tricky task for large organizations’ IT teams. To help them, some solutions such as security information and event management (SIEM) softwares are specifically designed to group and analyze large amounts of data and make them comprehensible at a human scale. By relying on these capabilities, a SIEM can alert on suspicious and potentially illegitimate behaviors, providing security heads with visibility in a security context.
What is SIEM?
A SIEM solution allows security heads to keep track of any activities within their IT environment in real-time as well as during specific periods. It gathers security logs from servers, mobile devices, domain controllers etc. to store and cross-analyze them. Altogether, it enables to draw trends, detect threats, and analyze security breach.
Why organizations use SIEM solutions?
Cyberthreats targeting organizations are more numerous than ever, as they are linked to the ever expanding enterprise mobility area. In the last years, Governments and authorities have enacted laws that require companies to protect the privacy of the data they handle and to monitor all actions performed on these data.
For example, the Article 30 of the GDPR (called “Records of processing activities”) requires that all organizations manipulating European citizens’ personal details record all the processing activities performed on the specific data. The goal being, at best, to prevent a data breach and at worst, to be ready to handle one, in both cases relying on alert notifications and precise forensics, inducing the use of a SIEM solution.
How does SIEM work?
In a SIEM, all the alerts can be defined in a custom security policy and classified with low or high priority. When the system identifies a security matter that could affect the organization, it immediately addresses the issue and assigns it with a priority. According to the raised alerts and reporting provided, security heads have sufficient insights to take appropriate countermeasures.
For example, if a user tries to log into its company intranet but fails 5 times to fill his password in a 5-minute span, it is classified as a low-level alert as he might just have forgotten his password. However, if 100 login attempts are recorded in a 5-minute span, it’s probably a brute-force attack trying to hack the user’s credentials. Hence, this is flagged as a high severity incident and raises an alert.
Enrich SIEM with mobile security data
To provide accurate results, a SIEM must be connected to the digital environment it evolves in, including the mobile surface where millions of events happen on a daily basis. Indeed, keeping track of mobile security has become key to securing any digital framework and IT leaders’ current challenge is to find enterprise mobility event collection tools that they can directly plug to their SIEM.
By running at the heart of mobile devices, Pradeo mobile security solutions provides IT teams with the opportunity to extract security events from the mobile environment. Whether their need is to monitor the security levels of a mobile fleet (Mobile Threat Defense on-device agent) or to analyze the mobile threat landscape surrounding an application (In-App Protection SDK), Pradeo’s solutions offer the possibility to enrich SIEMs with precise mobile security events, besides ensuring its protective purpose.
To facilitate and optimize the exploitation of the mobile security events extracted by the Pradeo Security sensor, Pradeo developed SIEM connectors. We are integrated with IBM QRadar, Splunk, ArcSight and using syslog, which makes us compatible with LogRythm, SmartEvent, RSA, McAfee, Fortinet and AlienVault.
You might also be interested in:
