Cybersecurity Processes And Technologies

Case Scenario:

Security Operations Control Centers (SOCC) are a necessity for large businesses and government agencies. But, for a small to medium sized business such as Sifers-Grayson, the expense of setting up and operating a SOCC may outweigh the benefits. Instead of a full SOCC, smaller companies may decide to invest in an enterprise monitoring technology such as a Security Information and Event Management (SIEM) tool. Such tools can be used by to monitor the enterprise, collect information, and report upon security events (generate alerts and alarms). Your task for this case study is to identify, assess, and recommend an SIEM tool which is appropriate for Sifers-Grayson and which could be used to support the activities of a SOCC should Sifers-Grayson decide to establish this organization as a separate operating unit.

The major assignment due this week is: Case Study #4: SIEM Technology & Product Review. For this assignment, you will research SIEM technologies and then write a product review for a currently available product. These products collect, analyze, and report on event data generated by network sensors, intrusion detection systems, firewalls, etc. Product capabilities include real-time monitoring & threat analytics. (The SIEM readings from this week should be completed before beginning your research and writing for your selected SIEM product.) 

Research:

2. Choose one of the SIEM products from the Gartner Magic Quadrant analyses.

3. Research your chosen product using the vendor’s website and product information brochures. (Vendors for highly rated products will provide a copy of Gartner’s most recent Magic Quadrant report on their websites but, registration is required.)

4. Find three or more additional sources which provide reviews for (a) your chosen product or (b) general information about SIEM technologies and solutions.

Write:

Write a minimum of 3 pages summary of your research. At a minimum, your summary must include the following:

1. An introduction or overview for the security technology category (SIEM).

2. A review of the features, capabilities, and deficiencies for your selected vendor and product

3. Discussion of how the selected product could be used by your client to support its cybersecurity objectives by reducing risk, increasing resistance to threat loss/attacks, decreasing vulnerabilities, etc.

4. A closing section in which you restate your recommendation for a product (include the three most important benefits).