Case Study #4: Technology & Product Review for an SIEM Solution
Case Scenario:
Security Operations Control Centers (SOCC) are a necessity for large businesses and government agencies. But, for a small to medium sized business such as Sifers-Grayson, the expense of setting up and operating a SOCC may outweigh the benefits. Instead of a full SOCC, smaller companies may decide to invest in an enterprise monitoring technology such as a Security Information and Event Management (SIEM) tool. Such tools can be used by to monitor the enterprise, collect information, and report upon security events (generate alerts and alarms). Your task for this case study is to identify, assess, and recommend an SIEM tool which is appropriate for Sifers-Grayson and which could be used to support the activities of a SOCC should Sifers-Grayson decide to establish this organization as a separate operating unit.
Research:
1. Review the weekly readings.
2. Choose one of the SIEM products from the Gartner Magic Quadrant analyses.
3. Research your chosen product using the vendor’s website and product information brochures. (Vendors for highly rated products will provide a copy of Gartner’s most recent Magic Quadrant report on their websites but, registration is required.)
4. Find three or more additional sources which provide reviews for (a) your chosen product or (b) general information about SIEM technologies and solutions.
Write:
Write a 3 page summary of your research. At a minimum, your summary must include the following:
1. An introduction or overview for the security technology category (SIEM).
2. A review of the features, capabilities, and deficiencies for your selected vendor and product
3. Discussion of how the selected product could be used by your client to support its cybersecurity objectives by reducing risk, increasing resistance to threats/attacks, decreasing vulnerabilities, etc.
4. A closing section in which you restate your recommendation for a product (include the three most important benefits).
As you write your review, make sure that you address security issues using standard cybersecurity terminology (e.g. protection, detection, prevention, “governance,” confidentiality, integrity, availability, nonrepudiation, assurance, etc.). See the ISACA glossary https://www.isaca.org/pages/glossary.aspx if you need a refresher on acceptable terms and definitions.
As you write your review, make sure that you address security issues using standard cybersecurity terminology (e.g. 5 Pillars IA, 5 Pillars Information Security). See the resources listed under Course Resources > Cybersecurity Concepts Review for definitions and terminology.
Additional Information
1. There is no penalty for writing more than 3 pages but, clarity and conciseness are valued. If your case study paper is shorter than 3 pages, you may not have sufficient content to meet the assignment requirements (see the rubric).
2. Your paper should use standard terms and definitions for cybersecurity. See Course Content > Week 1 > Cybersecurity Concepts Review for recommended resources.
3. You must include a cover page with the assignment title, your name, and the due date. Your reference list must be on a separate page at the end of your file. These pages do not count towards the assignment’s page count.
4. You are expected to write grammatically correct English in every assignment that you submit for grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying that your punctuation is correct and (d) reviewing your work for correct word usage and correctly structured sentences and paragraphs.
5. You are expected to credit your sources using in-text citations and reference list entries. Both your citations and your reference list entries must follow a consistent citation style (APA, MLA, etc.).
6. Consult the grading rubric for specific content and formatting requirements for this assignment.