Cyber Defense eMagazine March Edition for 2022

• Identity and Access Analytics – Next-gen SIEM uses Identity Analytics (IdA) leveraging data
science that monitors for and identifies risky access controls, entitlements, user behaviors, and
associated abnormal or deviant activity. These types of advanced analytics data can also serve
key indicators for provisioning, de-provisioning, authentication, and privileged access
management by IAM teams. IdA surpasses human capabilities by leveraging machine learning
models to define, review and confirm accounts and entitlements for access, and works with risk
analytics to prioritize suspicious activity as more malicious.
• Cross-Channel Fraud Prevention – Next-gen SIEM offers modern fraud detection capabilities with
the ability to link data from a multitude of sources to provide a contextual view of what’s happening
in the environment. Such platforms highlight anomalous transactions based on historic user and
community profiles so analysts can initiate investigations or execute automated remediation
actions. It analyzes online and offline activity, including public records, contact center interactions,
point of sale transactions, ATM transactions, and more. It mines and normalizes data and then
creates a risk score for fraud and abuse which can be used for real-time decision making.
The ability to combine these elements to best suit the needs of an organization offer SecOps power and
flexibility when protecting users and the business from data exfiltration, cyber fraud, privilege access
abuse, account compromise and more – using behavior and context. As a result, teams can prioritize
risks and alerts, quickly investigate problems, automate risk response, have a comprehensive view of
case management, conduct contextual natural language search and more, all consolidated into a single
management console.
As the consolidation of security capabilities continues, providers are working to layer on more capabilities
to further unify security, including UEBA, SOAR and XDR. They’re also working to provide better security
and to lower capital and operational requirements, including scaling, training, management, and
maintenance. In addition, security operations teams have long invested and been focused on external
threats. This has led to a lack of monitoring for insider threats. As part of the foundation of a successful
security program, teams must monitor for both external and internal threats. And a mature UEBA set of
capabilities should be incorporated to fully protect the organization.
What questions should you be asking today about your SIEM or to your SIEM provider?
• How is the SIEM platform delivered? The ability to run as a collection of services entirely within
the cloud makes it ideal for risk analysis of security data. Organizations have the advantage of
aggregating and analyzing data from worldwide sources in a single application instance. These
platforms must also scale (both up and down) to accommodate varying workloads. Furthermore,
a cloud-native solution is often easier to maintain over time since the vendor can perform
upgrades quickly, and in real-time.
• Do they offer open analytics and allow teams to easily modify and build customer ML models?
Open analytics are critical for security teams to be able to customize their ML models to suit their
specific needs or build their own models. It’s important to understand exactly what goes into a
model to be confident in its output. With black box analytics, results must be taken on faith since
nobody knows how the answers are obtained, or if the results are valid.
Cyber Defense eMagazine – March 2022 Edition 58
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.