A telecommunications company uses a centralized Security Information and Event Management (SIEM) system to collect and analyze security logs from across its entire infrastructure. The SIEM is configured to generate alerts for specific suspicious activities, such as multiple failed login attempts from a single IP address or unusual data egress patterns. However, the security operations center (SOC) team frequently struggles with a high volume of low-priority, unactionable alerts, leading to 'alert fatigue' and a risk of legitimate threats being missed. Which of the following is the MOST appropriate immediate action for the CRISC professional to recommend to improve the effectiveness of control monitoring?
- AOutsource the entire SOC function to a managed security service provider (MSSP).
- BImplement a new, more advanced SIEM system.
- CRefine SIEM correlation rules and alert thresholds.
- DIncrease the number of security analysts in the SOC.
Show answer & explanationAnswer & explanation
Correct answer: C. Refine SIEM correlation rules and alert thresholds.
The core problem is 'alert fatigue' due to a 'high volume of low-priority, unactionable alerts.' This indicates that the SIEM's current configuration (correlation rules and alert thresholds) is not effectively distinguishing between noise and actual threats. Refining these rules and thresholds directly addresses the root cause by making the alerts more relevant and actionable, thus improving the effectiveness of control monitoring.
Why the other options are wrong
- A. Outsourcing is a significant strategic decision that might address the symptom but doesn't necessarily solve the underlying issue of poorly configured monitoring, and it's not an 'immediate' operational improvement for effectiveness.
- B. A new SIEM system might offer more features, but without proper configuration, it could lead to the same problem. This is a costly and potentially unnecessary step.
- D. Increasing staff without addressing the root cause of unactionable alerts would likely only spread the fatigue, not solve it.
Control Monitoring Optimization
Control monitoring optimization involves continuously refining the processes, tools, and configurations used to detect control failures or risk events, ensuring that monitoring outputs are relevant, actionable, and efficient.
- Aims to reduce false positives and improve true positive detection.
- Involves tuning configurations, rules, and thresholds.
- Crucial for preventing alert fatigue and ensuring timely response.
Memory trick: Tune the noise, so the signal shines.