Organizations worldwide are well past the point of believing that perimeter-based defenses are all one needs to ensure the protection of confidential data. Mainstay prevention technologies have been around for years and remain vital, yet they struggle to fully safeguard a company's most sensitive assets. A cursory glance of the headlines reveals that attackers are finding great success infiltrating even the most security-mature of businesses.
And why wouldn't they? Between the automation, specialization and professionalization of the criminal underground, the expansion of the attack surface, the erosion of the traditional perimeter, and the lax and inconsistent adherence by employees to security policies and processes, many organizations are prey for even the most rudimentary of adversaries.
That's where security information and event management (SIEM) solutions come in. SIEM has been a logical solution for businesses to equip themselves with technology that alerts them when risky activity has occurred in their environment. Organizations need to know as early as possible to limit the damage and losses. After being alerted, they must quickly understand what the intruders have accomplished, which systems they have compromised and how to halt them in their tracks before they can impart any further damage. In addition, companies must be able to respond - both faster and in a more informed way - so they can assist law enforcement when circumstances require.
This has been the promise of SIEM for many years. Sounds easy enough, right? But we all know things are not as easy as we're told.
While the latest SIEM systems are more capable than their predecessors, they come with a Catch-22. Their effectiveness and sophistication bring a special requirement: The need for skilled professionals to run them. SIEMs not only require basic system administration to perform tasks like running health checks on software, hardware and storage - but also more seasoned skillsets, including the ability to examine data, knowledge of systems across the IT infrastructure, experience with nearly all security point solutions, and the ability to define and analyze threat correlations.
That last skillset is an advanced discipline that requires a deeper knowledge of math, data and the broader IT infrastructure. Picture someone with a computer science, or similar, degree and at least five years of hands-on IT security experience. Most companies simply lack these operational capabilities in the form of human talent - and as a result, a disproportionate number of SIEM deployments have failed to meet their goals.
Companies are searching for, but apparently not finding, many suitable candidates. The skill level of the security workforce is dismal and shows no imminent signs of turning around, but we were stunned by its extent after perusing the notable online job boards hawking available SIEM positions.
We scoured:
- Dice.com, and found 441 postings with "SIEM" in title or description in the past week,
- Monster.com, and found 1,000+ postings for "SIEM security" in the past two weeks,
- Glassdoor.com, and found 395 postings with "SIEM security analyst" in the past week,
- Techcareers.com, and found 331 postings with "SIEM analyst in past two weeks, with more than 150 new postings every week for nearly two months.
So, what do these numbers really mean? Let's compare them to numbers around more common IT positions, such as IT data analyst, desktop support analyst and business intelligence analyst. Organizations will have many positions with these general titles, in the neighborhood of three to five times as many compared to a single, niche application like SIEM. So you'd expect to see openings for these positions far outstripping those for SIEM positions.
But that wasn't what we found. Not even close. Sure, there were more openings for generalist IT positions than specifically for SIEM, but not on the scale you'd expect. For example, we found:
- On Monster.com, 971 postings for the past week for general IT data analyst
- On Techcareers.com, 237 postings in past two weeks for desktop support positions
The demand for SIEM expertise is far outpacing the supply, which means organizations have to get creative in how they fill their skills void to achieve satisfaction. Otherwise, they may never have enough of the right people to utilize their investment.
One option is to offload the work to an established partner that is well versed in advanced correlation and threat management, deep forensics and Big Data, and offers round-the-clock support, integrated threat intelligence and compliance assistance. Trustwave offers a flexible Managed SIEM service that enables the customer to select the services they need to best fit their strategy, objectives and organizational resources.
With a managed services approach, you don't have to fight for talent on the job boards to make your SIEM successful.
Thomas Savage is a product marketing manager at Trustwave.
