%20cropped.jpg)
In the United States, ransomware is estimated to cost $7.5 billion a year in damages. This is why all businesses and organizations need to be proactive about their cybersecurity plans.
Back in 2000, organizations were surprised when the ILOVEYOU virus was spread globally via email, clogging servers and crippling daily business. Today’s cyber threats are much more sophisticated and menacing in their attempts to gain access inside an organization.
Creating a proactive cybersecurity plan now could save your organization from future headaches – and costly downtime.
Here’s what you’ll need to know to get started:
- What Is SIEM?
- What Is a SOC?
- How Do SIEM and SOC Work Together?
- Case Study: A Phishing Cyberattack
- Watch for These Cyberattack Tricks of the Trade
What Is SIEM?
Security Information and Event Management (SIEM) is a combination of two technologies:
- Security Information Management (SIM) which focuses on long-term storage, analysis and reporting of log data.
- Security Event Manager (SEM) which provides monitoring in real time, correlation of events and sends alert notifications.
Together, these technologies form SIEM, a powerful tool that organizations use to monitor, analyze and report on their systems.
SIEM can quickly process large amounts of data generated from an organization’s network, email system, spam filters, website, firewalls, etc. This tool can be programmed with rules to follow if an anomaly is identified. These rules are designed to quarantine systems, deploy remediation software and/or send an alert to human administrators for further analysis.
Artificial Intelligence (AI) and machine learning (ML) are often components of SIEM. AI and ML allow SIEM to gather and process a plethora of data as compared to what humans alone could do.
What Is a SOC?
A Security Operations Center (SOC) is a team comprised of the people designated to monitor and respond to cyber threats at an organization in real time. This team may be formed from in-house staff or outsourced to a Managed IT provider.
This team monitors an organization’s network 24/7 – often with the assistance of AI-based monitoring technology. The SOC’s goals are to address known network vulnerabilities, ward off potential threats and coordinate detection, response and recovery efforts if a cyberattack occurs.
A SOC is a crucial part of any business looking to keep their network secure. On the surface, this team works with the present network. In addition, a SOC conducts research and constructs a roadmap for future organizational security efforts.
How Do SIEM and SOC Work Together?
SIEM is typically the key tool used as part of an organization’s SOC. With the assistance of SIEM, the time it takes to discover potential threats or stop a cyberattack is dramatically reduced. This saves a lot of time, compared to human-only monitoring and intervention.
Together SIEM and SOC form a strong, multi-layered incident management plan against cyberattacks.
Wondering how this all works in real life? Read on for an example of a phishing attack that a client encountered and how it was neutralized.
Case Study: A Phishing Cyberattack
Phishing emails are one of the most common tactics that threat actors use to gain access to sensitive organizational data.
Recently, an Elevity client received a phishing email cleverly disguised to look like a real email asking for an Office 365 password reset. When a user took the “bait” and clicked on a link, they were taken to a webpage asking for their password. The user entered their password and unknowingly gave the attacker a foot in the door.
Luckily, the organization had a policy in force that required multi-factor authentication to do a password reset. This often stops an attack. However, if the user okays the reset, the threat actor will be able to access the user’s account. Unfortunately, this was the case.
Human error often is a part of many cyberattacks. Threat actors prey on normal human tendencies in the hopes that a user will not investigate the request and instead will do what is asked. After all, clicking a link is much faster than critically scouring a suspicious email to determine if it is legit.
The first few preventative layers of Elevity’s layered approach to cybersecurity seamlessly block everyday issues but failed in this instance to catch the breach. The SIEM/SOC caught the error allowed for a swift response, showing just how effective this security combination is. The SIEM reviewed the log data and saw two items of note:
- A password reset request coming from outside of the United States
- A multi-factor authentication response to that request coming from Madison, Wisconsin
The SIEM technology had a correlation rule that found this combination to be suspicious. Therefore, the organization’s SOC, which included Elevity, was notified of this anomaly. Ten minutes after the attack was launched, the affected user’s account was locked down and the attack was stopped.
Without a SIEM/SOC solution, this attack could have continued unnoticed for weeks or even months. Time that could have given a threat actor leverage to launch a costly ransomware attack.
A SIEM/SOC solution is the right strategy for network security. When they are set up properly and you have the right team in place, the odds are in your favor to thwart potential attacks.
Watch for These Cyberattack Tricks of the Trade
Cyber threats are always evolving. Besides phishing, other types of attacks that are frequently used to target businesses include:
- Malware
- SQL injection
- Cross-site scripting
- Unsecured Internet of Things (IoT) devices
- Insider threats
Proactive cybersecurity plans are necessary to provide protection for every business. What is your approach to cybersecurity?
Elevate Your Approach to Cybersecurity
Does your organization need help to reinforce your cybersecurity posture? Elevity’s layered, proactive approach to cybersecurity protects organizations of all sizes from evolving cyberattacks, sneaky hackers and destructive data breaches. And if an attack does succeed, you’ll already have a response plan in place designed to minimize the damage.
Searching for peace of mind in the knowledge that your data, users and network are well-protected? Contact Elevity for an introductory consultation to see if a managed IT partner is right for your organization.
