SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM)
1 1. INCOMPLETE LOG COLLECTION
Problem 1. A Security Information and Event Management (SIEM) system is supposed to col-
lect logs from four different sources every hour. In a particular day, the SIEM system only collected
logs from 3 out of the 4 sources. If the expected number of logs from each source is as follows:
Source 1 - 500 logs, Source 2 - 700 logs, Source 3 - 400 logs, and Source 4 - 600 logs, find the
total number of missing logs for that day.
Solution 1. Let’s calculate the total number of logs expected to be collected: Total expected
logs = Number of logs from Source 1 + Number of logs from Source 2 + Number of logs from Source
3 + Number of logs from Source 4 Total expected logs = 500 + 700 + 400 + 600 Total expected
logs = 2200 logs
The SIEM system only collected logs from 3 out of the 4 sources. Let’s find the total number of
logs collected: Total logs collected = Number of logs from Source 1 + Number of logs from Source
2 + Number of logs from Source 3 Total logs collected = 500 + 700 + 400 Total logs collected =
1600 logs
To find the total number of missing logs, we subtract the total logs collected from the total
expected logs: Missing logs = Total expected logs - Total logs collected Missing logs = 2200 - 1600
Missing logs = 600 logs
Therefore, the SIEM system missed a total of 600 logs for that day.
2 2. FALSE POSITIVES AND FALSE NEGATIVES
Problem 2. The Security Operations Center (SOC) of a company uses a SIEM tool to monitor
network traffic for potential security incidents. The tool has an accuracy of 90% in detecting true
positives and a false positive rate of 5%. In a day, the SOC receives 200 alerts from the SIEM tool.
a) Calculate the expected number of true positive alerts.
b) Calculate the expected number of false positive alerts.
c) Determine the precision of the SIEM tool.
Solution 2.
a) To calculate the expected number of true positive alerts, we first need to determine the true
positive rate. True Positive Rate = 90% = 0.90
Expected true positive alerts = True Positive Rate ×Total Alerts = 0.90 ×200 = 180 alerts
Therefore, the expected number of true positive alerts is 180.
b) To calculate the expected number of false positive alerts, we first need to determine the false
positive rate. False Positive Rate = 5% = 0.05
Expected false positive alerts = False Positive Rate ×Total Alerts = 0.05 ×200 = 10 alerts
Therefore, the expected number of false positive alerts is 10.
c) Precision is defined as the ratio of true positive alerts to the total number of positive alerts
reported by the tool. Precision = True Positive Rate / (True Positive Rate + False Positive Rate) =
0.90 / (0.90 + 0.05) = 0.90 / 0.95 = 0.9474 or 94.74%
Therefore, the precision of the SIEM tool is 94.74%.
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
3 3. LACK OF INTEGRATION WITH OTHER SECURITY TOOLS
Problem 3. A company’s SIEM system is not integrated with their firewall logs, which are stored
separately. The SIEM system processes 500,000 events per day, while the firewall generates
1,200,000 log entries per day. If 80
Additional context: The firewall logs are being integrated into the SIEM system to enhance
security monitoring and threat detection capabilities.
a) Calculate the number of firewall logs related to routine traffic that can be filtered out.
b) Determine the total number of non-routine firewall logs that need to be processed.
c) Find the final number of events that need to be processed after integrating the firewall logs
with the SIEM system.
Solution 3.
a) The number of firewall logs related to routine traffic that can be filtered out is calculated as
follows:
Number of firewall log entries per day = 1,200,000
Percentage of logs related to routine traffic = 80
Number of routine firewall logs = 1,200,000 * 0.80 = 960,000
Therefore, 960,000 firewall logs can be filtered out as routine traffic.
b) The total number of non-routine firewall logs that need to be processed is:
Total firewall logs - Routine firewall logs = 1,200,000 - 960,000 = 240,000.
Therefore, there are 240,000 non-routine firewall logs that need to be processed.
c) After integrating the firewall logs with the SIEM system, the final number of events that need
to be processed is the sum of the original SIEM events per day and the non-routine firewall logs:
Final number of events = SIEM events + Non-routine firewall logs Final number of events =
500,000 + 240,000 Final number of events = 740,000 events per day.
Therefore, after integrating the firewall logs with the SIEM system, 740,000 events need to be
processed each day.
4 4. INEFFICIENT EVENT CORRELATION
Problem 4. A Security Information and Event Management (SIEM) system receives 5000
events per hour. It takes an average of 2 minutes to analyze each event using the current correla-
tion rules. The SIEM team decides to implement a new correlation rule that reduces the analysis
time to 1 minute per event. How much time will be saved in one hour by implementing the new
correlation rule?
Solution 4. Let’s first calculate the total time taken to analyze events in one hour using the
current correlation rules:
Total time taken = Number of events ×Analysis time per event
Total time taken = 5000 events ×2minutes
60 minutes
Total time taken = 5000 events ×1
30 hours
Total time taken = 166.67 hours
Now, let’s calculate the total time taken to analyze events in one hour using the new correlation
rule:
Total time taken = 5000 events ×1minute
60 minutes
Total time taken = 5000 events ×1
60 hours
Total time taken = 83.33 hours
Time saved in one hour = Time taken with current rules - Time taken with new rule
Time saved in one hour = 166.67 - 83.33
Time saved in one hour = 83.34 hours
Therefore, by implementing the new correlation rule, the SIEM team will save 83.34 hours in
one hour of analysis.
5 5. LIMITED SCALABILITY
Problem 5. A Security Information and Event Management (SIEM) system is currently able to
process 5000 events per second. The organization expects their event load to increase by 50
Solution 5. a) Calculate the increase in the event load by 50
Increase in event load =50
100 ×5000
= 0.5×5000
= 2500
b) Determine the new maximum event load after the increase:
New maximum event load = 5000 + 2500
= 7500
c) Therefore, after the expected 50
6 6. DATA OVERLOAD AND INFORMATION FATIGUE
Problem 6. An organization’s SIEM system collects logs from multiple sources at a rate of
500,000 events per hour. If each event contains an average of 2KB of data, calculate the total
amount of data processed by the SIEM system in a day.
Assume:
•There are 24 hours in a day.
Solution 6.
Given:
•Events per hour: 500,000
•Data per event: 2KB
•Hours per day: 24
a) Calculate the total data processed by the SIEM system in a day:
Events per day =Events per hour ×Hours per day
= 500,000 ×24
= 12,000,000
Data processed per day =Events per day ×Data per event
= 12,000,000 ×2KB
= 24,000,000KB
b) Convert the total data processed to GB:
Data processed in GB =24,000,000KB
1024
≈23,437.5GB
Therefore, the SIEM system processes approximately 23,437.5 GB of data in a day.
I can certainly generate numerical problem questions on SIEM. Let’s consider the following
problem on identifying and responding to security incidents:
7 7. DIFFICULTY IN INCIDENT RESPONSE
Problem 7. A company uses a SIEM system to monitor its network traffic. The SIEM system
detects an unusually high number of failed login attempts from an internal user account within a
short period. The security team suspects a brute force attack. The SIEM logs indicate that over a
5-minute interval, there were 100 failed login attempts from the same internal user account. Each
failed login attempt triggers an alert.
The security team decides to block further login attempts from the suspicious account for 30
minutes. The SIEM system sends an automated response to block the account after a threshold
of 50 failed login attempts is reached. Assuming the attack continues at the same rate, calculate:
a) How many more failed login attempts would trigger the automated response to block the
account?
b) How long would the account be blocked for once the automated response is triggered?
c) If the attack continues at the same rate, how many more alerts would be triggered before the
account is blocked?
Solution 7.
a) To trigger the automated response to block the account, the security team has to wait until
the threshold of 50 failed login attempts is reached. Since there were already 100 failed attempts
in a 5-minute interval, we can calculate the additional number of failed attempts needed to trigger
the automated response:
Additional failed attempts needed = 50 −100 = −50
Since the value is negative, this means the automated response should have been triggered al-
ready.
b) Since the threshold of 50 failed attempts has already been exceeded, the account would be
blocked for the specified duration of 30 minutes.
c) The number of alerts triggered can be calculated by dividing the total failed attempts by the
trigger threshold:
Number of alerts triggered before blocking =100
50 = 2
Therefore, 2 alerts would be triggered before the account is blocked.
7.1 8. INADEQUATE USER ACTIVITY MONITORING
Problem 8. A company’s SIEM system detected that a user account attempted to log in 15
times within 1 minute, which is unusual behavior. The company’s security policy states that any
user account with more than 10 failed login attempts within 1 minute should be automatically locked
out. The SIEM system generates an alert to the security team for investigation.
a) Calculate the average number of login attempts per second for this user account.
b) If the SIEM system logs every login attempt and the average data size for each log entry is
50 bytes, calculate the total data generated by this user account during the 1-minute period.
c) If the company has a threshold of 100 MB for data storage per user account within a 24-hour
period, would this user account exceed the storage limit based on the data generated in 1 minute?
Solution 8.
a) The average number of login attempts per second can be calculated by dividing the total
number of attempts (15) by the total time in seconds (60 seconds).
a) Average login attempts per second = 15
60 = 0.25 attempts per second.
b) The total data generated by this user account during the 1-minute period can be calculated
by multiplying the average data size for each log entry by the total number of login attempts.
b) Total data generated = 50 bytes ×15 = 750 bytes.
c) To determine if the storage limit would be exceeded, we need to convert the total data gen-
erated to megabytes (MB).
c) Total data generated in MB = 750
1024 MB ≈0.7324 MB.
Since the total data generated in 1 minute is less than 1 MB, it would not exceed the company’s
threshold of 100 MB for data storage per user account within a 24-hour period.
8 9. LACK OF CUSTOMIZATION AND FLEXIBILITY
Problem 9. Some SIEM systems lack customization and flexibility which can limit their effec-
tiveness in detecting and responding to security incidents. As a result, an organization has decided
to switch to a more customizable SIEM solution. They are considering two options - Option A and
Option B.
For Option A, the organization can customize the alert rules based on specific criteria, such
as IP addresses, time of day, and event types, but it has a fixed dashboard layout that cannot be
modified.
For Option B, the organization can customize the dashboard layout, add or remove widgets,
and rearrange elements, but the alert rules cannot be altered and are based on preset conditions.
If the organization values customization of alert rules more than dashboard flexibility, they will
choose Option A. If they prioritize dashboard flexibility over alert rule customization, they will choose
Option B.
a) If the organization emphasizes alert rule customization and chooses Option A, what mathe-
matical symbol can be used to represent this decision?
b) If the organization places a higher priority on dashboard flexibility and chooses Option B,
how can this preference be mathematically expressed?
Solution 9.
a) The organization’s emphasis on alert rule customization and selection of Option A can be
represented mathematically as:
Customization (Option A) >Flexibility (Option B)
b) Conversely, the organization’s preference for dashboard flexibility and selection of Option B
can be expressed as:
Flexibility (Option B) >Customization (Option A)
I. In a SIEM system, the number of security events recorded in a log file over a period of 1 hour
followed a Poisson distribution with a mean of 5 events per hour.
9 10. INCONSISTENT DATA NORMALIZATION
Problem 10. Consider the SIEM system described above.
a) Find the probability of observing exactly 3 security events in a given hour.
b) Calculate the probability of observing 6 or more security events in a given hour.
c) Determine the average number of security events that will be recorded in a 3-hour time period.
Solution 10.
a) Let X be the number of security events recorded in a given hour, which follows a Poisson
distribution with = 5. The probability of observing exactly 3 events can be calculated using the
Poisson probability mass function:
P(X=k) = e−λλk
k!
Therefore, for k = 3:
P(X= 3) = e−553
3! =e−5125
6≈0.1404
Hence, the probability of observing exactly 3 security events in a given hour is approximately
0.1404.
b) To find the probability of observing 6 or more security events in a given hour, we can calculate
the complementary probability of observing less than 6 events:
P(X≥6) = 1−P(X < 6) = 1−P(X≤5) = 1−(P(X= 0)+P(X= 1)+P(X= 2)+P(X= 3)+P(X= 4)+P(X= 5))
Using the Poisson probability mass function, we calculate each term and subtract it from 1 to
find the final probability.
c) The average number of security events recorded in a 3-hour time period can be calculated
using the property of a Poisson distribution that states the mean () is equal to the average number
of events over a given time period. Since the mean is 5 events per hour, the average number of
events in a 3-hour period would be:
Average number of events in 3 hours = 5 ×3 = 15
10 11. INSUFFICIENT THREAT INTELLIGENCE INTEGRATION
Problem 11. A company’s Security Information and Event Management (SIEM) system pro-
cesses an average of 500 security events per hour. If the SIEM system is not integrated with any
threat intelligence feeds, it can only detect known security threats with a probability of 0.8.
a) What is the expected number of known security threats detected by the SIEM system in a
10-hour period?
b) If the company integrates a new threat intelligence feed that increases the probability of
detecting known security threats to 0.9, what is the expected number of known security threats
detected in the same 10-hour period?
Solution 11. a) The expected number of known security threats detected by the SIEM system
in a 10-hour period without threat intelligence integration can be calculated using the formula for
expected value:
Expected number of events = Average events per hour ×Probability of detection
Expected number of known security threats detected in a 10-hour period = 500×0.8×10 = 4000
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period without threat intelligence integration is 4000.
b) With the integration of a new threat intelligence feed that increases the probability of detecting
known security threats to 0.9, the expected number of known security threats detected in the same
10-hour period can be calculated as:
Expected number of known security threats detected in a 10-hour period = 500×0.9×10 = 4500
Therefore, the expected number of known security threats detected by the SIEM system in a
10-hour period with the new threat intelligence feed integration is 4500.
I.
11 12. COMPLIANCE AND REGULATORY CHALLENGES
Problem 12.
A company needs to comply with a specific regulatory framework that requires all user access
to sensitive data to be logged and monitored. The SIEM system in place tracks the following user
activities over a month:
- User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times. - User
C accessed sensitive data 150 times.
If the regulatory framework sets a threshold of 100 accesses to be flagged for manual review,
how many users’ activities will trigger this review based on the data collected by the SIEM system?
Solution 12.
Given: - User A accessed sensitive data 120 times. - User B accessed sensitive data 90 times.
- User C accessed sensitive data 150 times. - Threshold for manual review: 100 accesses.
a) Calculating the number of users whose activities will trigger manual review:
Users triggering manual review are those who accessed sensitive data more than the threshold
of 100 times.
Therefore, User A (120 times) and User C (150 times) will trigger manual review as their access
counts exceed the threshold. User B (90 times) will not trigger manual review.
Hence, 2 users’ activities will trigger manual review.
11.1 13. UNAUTHORIZED ACCESS AND DATA BREACHES
Problem 13. An organization’s SIEM system detected 100 unauthorized login attempts within
a week. Out of these, 25 were successful logins. Calculate the success rate of these unauthorized
login attempts as a percentage.
Solution 13. a) Calculate the success rate of unauthorized login attempts:
The success rate can be calculated as:
Success rate (%) =Number of successful logins
Total number of attempts ×100%
Given that there were 100 unauthorized login attempts and 25 were successful, we have:
Success rate (%) =25
100×100% = 25%
Therefore, the success rate of unauthorized login attempts is 25
b) What is the failure rate of these unauthorized login attempts as a percentage?
The failure rate can be calculated by subtracting the success rate from 100So, the failure rate
is:
Failure rate = 100% −25% = 75%
Therefore, the failure rate of unauthorized login attempts is 75
c) If the organization had a total of 500 login attempts during the week, what percentage of total
login attempts were unauthorized?
The percentage of total login attempts that were unauthorized can be calculated as:
Percentage of unauthorized attempts =Number of unauthorized login attempts
Total number of login attempts ×100%
Given that there were 100 unauthorized login attempts out of a total of 500 attempts, we have:
Percentage of unauthorized attempts =100
500×100% = 20%
Therefore, 20
12 14. INADEQUATE RESOURCE ALLOCATION
Problem 14. A company implemented a Security Information and Event Management (SIEM)
system to monitor its network traffic. The SIEM system only has the capacity to log 100,000 events
per hour. On a particular day, the system detected the following number of events in each hour:
Hour Number of Events
1 85,000
2 102,000
3 95,000
4 80,000
5 110,000
Calculate the following:
a) The percentage of events that could not be logged in each hour.
b) The total number of events that could not be logged throughout the day.
Solution 14.
a) To calculate the percentage of events that could not be logged in each hour, we need to sub-
tract the number of events from the capacity (100,000) and then divide by the capacity, multiplied
by 100 to get the percentage.
1. For Hour 1:
Events not logged = 100,000 −85,000 = 15,000
Percentage =15,000
100,000 ×100 = 15%
2. For Hour 2:
Events not logged = 102,000 −100,000 = 2,000
Percentage =2,000
100,000 ×100 = 2%
3. For Hour 3:
Events not logged = 100,000 −95,000 = 5,000
Percentage =5,000
100,000 ×100 = 5%
4. For Hour 4:
Events not logged = 100,000 −80,000 = 20,000
Percentage =20,000
100,000 ×100 = 20%
5. For Hour 5:
Events not logged = 110,000 −100,000 = 10,000
Percentage =10,000
100,000 ×100 = 10%
b) To calculate the total number of events that could not be logged throughout the day, we sum
up the number of events not logged in each hour.
Total events not logged = 15,000 + 2,000 + 5,000 + 20,000 + 10,000 = 52,000 events.
13 15. POOR ALERT PRIORITIZATION
Problem 15. A Security Operations Center (SOC) analyst is reviewing alerts generated by the
SIEM system in a company. The analyst notices that there are 80 low-priority alerts, 50 medium-
priority alerts, and 20 high-priority alerts. The analyst has limited time and resources to investigate
a total of 100 alerts.
a) If the analyst decides to investigate 60
b) What percentage of the total alerts investigated by the analyst will be high-priority alerts?
Solution 15.
a) To calculate the total number of alerts the analyst will investigate:
Number of low-priority alerts investigated = 80 alerts ×60% = 48 alerts
Number of medium-priority alerts investigated = 50 alerts ×80% = 40 alerts
Number of high-priority alerts investigated = 20 alerts ×100% = 20 alerts
Total alerts investigated = 48 + 40 + 20 = 108 alerts
Since the analyst can only investigate 100 alerts, they will investigate 100 alerts.
b) To calculate the percentage of high-priority alerts investigated:
Percentage of high-priority alerts investigated = (Number of high-priority alerts investigated /
Total alerts investigated) ×100%
Percentage of high-priority alerts investigated = (20 / 100) ×100% = 20%
Therefore, 20% of the total alerts investigated by the analyst will be high-priority alerts.
14 16. LIMITED VISIBILITY INTO CLOUD SERVICES
Problem 16. A company is utilizing a SIEM tool to monitor its cloud services. The tool has a
visibility of 85
Solution 16. Given:
•Visibility in AWS = 85
•Visibility in Azure = 70
•Visibility in GCP = 60
•Number of security incidents in AWS = 100
•Number of security incidents in Azure = 80
•Number of security incidents in GCP = 50
a) For AWS: The SIEM tool can effectively monitor 85
0.85 ×100 = 85 incidents
b) For Azure: The SIEM tool can effectively monitor 70
0.70 ×80 = 56 incidents
c) For GCP: The SIEM tool can effectively monitor 60
0.60 ×50 = 30 incidents
Therefore, the total number of security incidents that the SIEM tool can effectively monitor is:
85 + 56 + 30 = 171 incidents
Thus, the SIEM tool can effectively monitor a total of 171 security incidents across the com-
pany’s cloud environments.
15 17. COMPLEXITY AND TRAINING REQUIRED
Problem 17. A Security Information and Event Management (SIEM) tool processes incoming
log data at a rate of 500 logs per minute. If a security analyst can review 20 logs per minute
on average, how many additional analysts are needed to keep up with the incoming log data in
real-time?
Solution 17.
Let’s first calculate how many logs can be reviewed by one analyst in a minute:
Logs per minute per analyst = 20
Now let’s calculate how many logs need to be reviewed in a minute:
Total logs per minute = 500
The number of additional analysts needed can be calculated by dividing the total logs per minute
by the logs reviewed per minute per analyst:
Additional analysts =Total logs per minute
Logs per minute per analyst =500
20 = 25
Therefore, 25 additional analysts are needed to keep up with the incoming log data in real-time.
16 18. MAINTENANCE AND UPGRADE DIFFICULTIES
Problem 18. A company’s SIEM system requires an upgrade to address security vulnerabilities
in the current version. The upgrade will cost 5000, butitisestimatedthatitwillsavethecompany2000
annually in potential security breaches. If the company’s discount rate is 6
Solution 18. Given: Upgrade cost = 5000
Annualsavingsduetoupgrade =2000
Discount rate = 6Number of years the system will be used = 5 years
a) Calculate the present value of the cost of the upgrade and the present value of the annual
savings over 5 years:
The present value of a future cash flow F V at a discount rate rwith nyears of compounding is
given by the formula:
P V =F V
(1 + r)n
Present value of the upgrade cost:
P Vupgrade =5000
(1 + 0.06)5=5000
(1.06)5≈3732.24 dollars
Present value of the annual savings:
P Vsavings =2000
0.06 1−1
(1 + 0.06)5≈8976.65 dollars
b) Calculate the net present value (NPV) of the upgrade:
NP V =P Vsavings −P Vupgrade = 8976.65 −3732.24 = 5244.41 dollars
c) Conclusion: Since the NPV of the upgrade is positive (5244.41 >0), it is financially beneficial
for the company to upgrade the SIEM system to address the security vulnerabilities in the long run
over the next 5 years.
17 19. THREAT OF DATA LOSS AND LEAKAGE
Problem 19. A company has implemented a Security Information and Event Management
(SIEM) system to monitor its network for any signs of data loss or leakage. The SIEM generates
alerts based on predefined rules and thresholds set by the security team. Over the past week, the
SIEM generated the following alerts related to potential data exfiltration incidents:
•Monday: 57 alerts
•Tuesday: 42 alerts
•Wednesday: 63 alerts
•Thursday: 38 alerts
•Friday: 72 alerts
a) Calculate the average number of alerts per day over the past week.
b) Determine the day with the highest number of alerts and the number of alerts generated on
that day.
c) If the security team has set a threshold of 50 alerts per day to trigger an immediate investi-
gation, how many days would have triggered an investigation based on the alerts received?
Solution 19. a) To calculate the average number of alerts per day, we sum up the total number
of alerts and divide by the number of days in the week:
Total alerts = 57 + 42 + 63 + 38 + 72 = 272
Average alerts per day =272
5= 54.4
Therefore, the average number of alerts per day over the past week is 54.4.
b) From the given data, the day with the highest number of alerts was Friday with 72 alerts.
c) To determine the number of days that would trigger an investigation based on the threshold
of 50 alerts per day, we check how many days had alerts greater than or equal to 50:
Days triggering investigation = 3 days (Monday, Wednesday, and Friday)
Therefore, based on the threshold set by the security team, 3 days would have triggered an inves-
tigation.
18 20. INEFFECTIVE CROSS-FUNCTIONAL COLLABORATION
Problem 20. A company’s Security Information and Event Management (SIEM) system col-
lected the following data on security incidents over the past month:
- Number of incidents detected by the Security Operations Center (SOC): 150 - Number of
incidents reported by the IT department: 80 - Number of incidents identified by the Network Op-
erations Center (NOC): 50 - Number of incidents discovered by the Incident Response team: 30 -
Total number of incidents missed or overlooked: 25
If we consider the intersection of incidents detected by the SOC, reported by the IT department,
identified by the NOC, and discovered by the Incident Response team only, find:
a) The number of incidents that were collaboratively detected by all four teams. b) The per-
centage of total incidents that were missed or overlooked. c) The percentage of total incidents that
were not reported by the IT department.
Solution 20. a) To find the number of incidents collaboratively detected by all four teams, we
need to find the intersection of the data provided:
Number of incidents collaboratively detected = 150+80+50+30−Total number of incidents missed or overlooked
= 150 + 80 + 50 + 30 −25 = 285
Therefore, the number of incidents collaboratively detected by all four teams is 285.
b) The percentage of total incidents that were missed or overlooked can be calculated by:
Percentage of incidents missed or overlooked =Total number of incidents missed or overlooked
Total number of incidents detected ×100%
=25
150 + 80 + 50 + 30×100% = 25
310×100% ≈8.06%
Therefore, the percentage of total incidents that were missed or overlooked is approximately
8.06
c) The percentage of total incidents that were not reported by the IT department can be calcu-
lated by:
Percentage of incidents not reported by IT =Number of incidents not reported by IT
Total number of incidents detected ×100%
=150 + 50 + 30 + 25
150 + 80 + 50 + 30×100% = 255
310×100% ≈82.26%
Therefore, the percentage of total incidents that were not reported by the IT department is
approximately 82.26
