CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingMedium
A multinational corporation uses a centralized Security Information and Event Management (SIEM) system to aggregate security logs from all its global subsidiaries. The security team reviews alerts daily, but there's concern that the sheer volume of data makes it difficult to detect sophisticated, low-volume attacks. To optimize control monitoring, which of the following approaches should the risk practitioner recommend FIRST?
- AIncrease the frequency of full penetration testing across all subsidiaries.
- BImplement advanced analytics and correlation rules within the SIEM.
- COutsource the SIEM monitoring to a managed security service provider (MSSP).
- DReduce the scope of log collection to focus only on critical systems.
Show answer & explanationAnswer & explanation
Correct answer: B. Implement advanced analytics and correlation rules within the SIEM.
The core problem is detecting sophisticated attacks within a high volume of data. Enhancing the SIEM's capabilities with advanced analytics and correlation rules directly addresses this by improving its ability to identify meaningful patterns and anomalies.
Why the other options are wrong
- A. Penetration testing is a valuable control, but it's a point-in-time assessment and doesn't directly optimize the continuous monitoring process described.
- C. Outsourcing is a valid strategy but should be considered after attempting to optimize internal capabilities, especially when the tool itself has room for improvement. It's not the 'first' recommendation for optimization.
- D. Reducing log scope might miss critical events from other systems and is generally a poor security practice, potentially hindering comprehensive threat detection.
Control Monitoring Optimization
The process of refining and improving the effectiveness and efficiency of controls that track and evaluate security performance.
- Aims to enhance detection capabilities.
- Often involves technology and process improvements.
- Focuses on efficiency and relevance of alerts.
Memory trick: SIEM: See, Identify, Evaluate, Monitor