CISA’s New SIEM Guidance Tackles Visibility and Blind Spots

U.S. and Australian cyber authorities are urging organizations to bolster detection and response platforms in new guidance that aims to close a growing visibility gap, as logging demands continue to surge across industries.

See Also: Security Workflow Automation Cuts Complexity

The U.S. Cybersecurity and Infrastructure Security Agency and the Australian Cyber Security Center released guidance Tuesday for integrating security information and event management platforms and automation tools into enterprise networks, emphasizing the need to focus on the most valuable log data to speed up threat detection and improve incident response.

The guidelines provide technical recommendations for cybersecurity practitioners on what logs should be prioritized for SIEM ingestion in a wide array of scenarios, and covers log sources including in a large variety of endpoint detection and response tools, Windows/Linux operating systems and cloud and network devices.

Organizations at every level of maturity are constantly assessing whether they have enough visibility into their environment and what blind spots may exist, said Allie Mellen, principal analyst of security and risk at Forrester. The visibility gap has become one of the biggest challenges in cybersecurity. The guidance seeks to address that gap, as she noted the question of “what logs are most important” remains a top concern for security teams aiming to avoid missing critical signals.

SIEM systems are a major budget item for security teams due to the high cost of large-scale log ingestion, Mellen told Information Security Media Group. Mellen said the guidance offers useful direction for mature and emerging security operations centers but it falls short in addressing how to operationalize the logs once they’re collected.

“While having visibility into the environment is helpful, it is only as useful as the detection measures the security team has implemented,” Mellen said. Improving detection coverage is just as critical as increasing visibility through logging, she added. “Detection coverage should feed into visibility and vice versa.”

SIEM and security orchestration, automation and response platforms can improve a human-led security team’s network visibility while enhancing its ability to detect and respond to cybersecurity events and incidents, according to the guidance. CISA and the ACSC advised practitioners to incorporate SIEM into their organization’s enterprise architecture by first establishing a baseline of “business-as-usual” activity on the network and developing a standard for the collection of logs.

The guidelines state that logging decisions should be based on the organization’s specific environment and risk profile, and tells practitioners to enable logging on operational technology devices where possible, as well as sending and storing logs in a centralized location.