Future of the SIEM

Current SIEM systems have flaws. Heres how the SIEMs role will change as mobile, cloud, and IoT continue to grow.

Ask security experts about security information and event management (SIEM) systems, and many will tell you SIEMs are becoming dated and need to be revamped.
The skepticism is understandable. How can SIEM, a multi-billion-dollar market around for many years, keep up as businesses adopt new technologies like cloud systems, mobile, and IoT? When it was invented, SIEM did exactly what organizations needed. Now their needs are more complex.
Behind the curve
SIEMs collect security events in real-time from various event and data sources.
[SIEM] was a place where you pumped in a whole bunch of data and figured out what was suspicious, says Larry Ponemon, chairman and founder of the Ponemon Institute. It gave you an alert, quarantined the traffic, sandboxed it.
For the most part, SIEM made a lot of sense from a business perspective. Dealing with potential attacks and vulnerabilities, without a tool, was like finding a pin in a stack of hay. It was virtually impossible to do manually.
As attackers became more sophisticated, SIEM systems have failed to keep up.
Today, those same products barely work at all, says Exabeam CMO Rick Caccia. Older systems arent built to capture credential or identity-based threats, hackers impersonating people on corporate networks, or rogue employees trying to steal data.
A recent
report
by the Ponemon Institute, commissioned by Cyphort, discovered 76% of SIEM users across 559 businesses view SIEM as a strategically important security tool. However, only 48% were satisfied with the actionable intelligence their SIEMs generate.
Caccia likens the current state of the SIEM market to the state of the firewall market six- to seven years ago, before entrants like Palo Alto Networks entered the space with a next-level product that could catch new attacks and quickly solve problems. Similarly, SIEM is struggling with stale technology, new threats, and a need for change.
Shortcomings and challenges
Many of SIEMs current shortcomings stem from its tough mission of monitoring security and detecting threats across the business, says Gartner vice president Anton Chuvakin. Its a hard problem to solve, no matter how security pros choose to tackle it.
If flying to the moon is hard, youre not going to say your rocket is crap, he quips. Its just difficult.
Complex mission aside, one key shortcoming of todays SIEM products is their reliance on humans. SIEM is, in that sense, more rule-based and expert-described, says Chuvakin. Thats a main weakness because at this point, were trying to get developed tools to try and think for themselves.
The dependence on human experts is a problem because there simply arent enough of them, he continues. If a business needs five SIEM experts and its entire IT team consists of five people, they dont have the bandwidth to ensure the SIEM is effective.
Amos Stern, co-founder and CEO of Siemplify, explains there is need for better SIEM automation and management of people and systems. Businesses often have several security tools in many silos. SIEM systems will need to connect these silos and automate processes and investigations across these tools, evolving to the point where they function as a Salesforce for security.
Caccia echoes the need for greater SIEM intelligence, noting how most systems rules cant keep up with attackers. For companies struggling with talent, he says, automation could help junior team members perform closer to an expert level.
SIEM implementation is another challenge. Its a process that sometimes costs more than the actual product, Stern says. Organizations wouldnt rip and replace their SIEMs with new technology. Right now many are only at the point where their SIEM deployment is mature, or mature enough, to not create a ton of noise.
Cloud, IoT, and the role of SIEM
SIEM challenges will continue to evolve as security managers grapple with cloud services, mobile, the Internet of Things, and other new technologies the IT department doesnt always control.
IoT will be a huge factor as it drives the number of endpoints vulnerable to attackers, says Ponemon. Its getting harder for cybercriminals to infiltrate computers but still fairly easy to hack cameras, refrigerators, microwaves, Bluetooth tools, and other connected devices and use them as an attack vector.
The growth of cloud, especially for SMBs, has transformed how businesses store and handle data. Companies once intimidated by high price of data storage benefit from SIEM providers like ArcSight, Nitro, and others that deploy modules from the cloud, he continues.
Cloud services and IoT devices will rapidly generate increasing amounts of data, and SIEM systems will have to adapt by learning to collect and organize the influx of information.
The SIEM evolution is about supporting more data types, supporting more problems, says Gartners Chuvakin, whose research has focused on user behavior analytics and machine learning. He anticipates these will help SIEM think on its own and relieve the need for human experts.
Ponemon emphasizes the importance of machine learning and analytics in the next wave of SIEM, but notes companies are hesitant to explore this space. They dont want to build products in an area where they lack the talent necessary to execute.
A lot of companies arent making that investment because they feel they dont have the internal resources to implement it properly, he says. They think the technology might get better; they dont want to be early adopters.
While this type of evolution is still a futuristic thing, progress is moving quickly, Ponemon says.
Whats up next?
The SIEM may need a face-lift, but it isnt going anywhere.
Its not on the way out, says Siemplifys Stern. Its been around for quite some time.
Caccia foresees several changes in the market shaping the growth of SIEM, including the growth of open-source big data technology and vendors focused on automated playbooks and incident response.
Chuvakin anticipates the immediate future will bring incremental improvements instead of major change. We wont see a break in the SIEM market, but small, gradual changes.
The future of SIEM will likely be an evolution, and not a revolution, he says.
Related Content:
Secrets of a Highly Productive CIO-CISO Relationship
New Metasploit Extension Available for Testing IoT Device Security
Getting Beyond the Buzz & Hype of Threat Hunting
New Wave of Security Acquisitions Signals Start of Consolidation Trend

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Future of the SIEM