Carpe SIEM: Seize The Cybersecurity Opportunity The Right Way - Shrikant Shitole, CEO, iValue Infosolutions

When business leaders and heads of state met at the World Economic Forum’s Annual Meeting 2023 in Davos, cybersecurity was one of the key discussion topics. As cyberattacks get increasingly sophisticated and frequent, INTERPOL’s Secretary-General Jürgen Stock called it “a global threat” and said it required a global response.

This alarm is not misplaced. 

In 2021, American financial enterprises lost close to $1.2 billion in costs due to ransomware attacks alone, almost 200 per cent over 2020’s figures. A recent Cybersecurity Ventures report predicted that the global annual cost of cybercrime is likely to cross $8 trillion. 

These astronomical figures reemphasize why private and public institutions should deploy proactive cybersecurity solutions that provide more advanced detection and response capabilities. 

Now, this does not mean that these entities were taking their cybersecurity lightly. Many already had set up Security Information and Event Management (SIEM) systems to safeguard their digital assets. However, the evolving threat landscape requires them to think several steps ahead of cybercriminals, who are constantly developing newer ways to breach through these networks. 

This has compelled companies to reevaluate their SIEM systems to ensure they are not locking the stable doors after the horses have bolted. Fortunately, it is not as daunting as it appears.

Revisiting The Basics

Typically, SIEM deployments are preemptive in nature, attempting to identify potential insider threats before they occur. Though these are often caused by negligence rather than malicious intent, it does not have any bearing on the final damage.

By identifying threats and monitoring them using Internet of Things technology, companies can make timely decisions about the right course of action. This could be across their varied architecture – from on-site networks to a multi-cloud environment. 

While adopting these measures will help them stay a step ahead of cybercriminals, they need to embrace new-age technologies like AI and ML to stay ahead of the curve.

Why AI And ML?

Conventional SIEM systems are well-equipped to manage and analyze data about security incidents. However, given the rapidity with which attack vectors evolve, they might face latency issues. 

Moreover, since these systems work on rule-based methods, they are not very adept at detecting unidentified threats that fall outside these parameters. As companies continue to generate a larger quantum of information from various channels, traditional SIEM systems might be unable to process this data in real time. What makes this worrying is that even a millisecond gap can be disastrous while dealing with cyber threats.

This is where AI and ML can step in. Their inherent ability to self-learn and do it promptly by analyzing large data sets can offer businesses SIEM alternatives to protect their networks from emerging cyber threats. 

AI and ML can also identify patterns to predict potential threats by analyzing vast amounts of data at fast speeds in real time. Speedy detection is the key to faster mitigation of these threats, safeguarding companies from potential financial and reputational issues. Companies can leverage the power of these data-driven insights to uncover and react to threats more effectively to evolving cyberattacks.

Mapping A Relevant SIEM Strategy

To harness the next generation of SIEM alternatives, companies need to map their cybersecurity so that it is future-proofed and can keep pace with a complex and evolving digital landscape. This will also help them optimize their budget without overshooting it and maximize the security infrastructure.

The first step in this direction is making a checklist of what matters most depending on the company’s IT and business roadmap. For instance, if they can decide how much they want to earmark for digitization or data backup and then move backwards to see how to align this with their security policies.

This will help companies set down a well-defined foundation for their cybersecurity protocols. They can then set milestones along the way, which cover setting up firewalls, endpoint detection and response points, and periodic workforce training. Setting up these goalposts and adhering to them religiously will reduce the risk of falling prey to cyberattacks.

Adopting this strategy will help companies to achieve one more goal—of not exhausting their depleting IT budgets while managing the constant barrage of cyber threats. The IT team can then devote their time and energies to identifying pivotal threats likely to penetrate their defence structure and then plug those gaps. 

Companies can also reap the benefits of AI and ML to automate repetitive tasks and streamline incident response processes. These can be integrated with existing solutions to build a comprehensive security ecosystem that can adapt to emerging threats.

Moreover, by relying on AI and ML companies can bridge the current talent gap that is currently existing in the marketplace. For overworked security teams, it offers a practical way forward. 

One hundred per cent of respondents in a Wakefield Research study stated that increased automation in the security operations centre would help them staffing gaps in their teams. Automation is a guardrail against the vagaries of human resources challenges, especially for companies with smaller IT teams. 

By setting up a next-generation cybersecurity strategy, companies can reduce the time to detect and respond to threat incidents. This can minimize the harm to their financial standing and branding, strengthening their cybersecurity posture.