Five Reasons SIEM Deployments Fail

Security information and event management deployments are often plagued by ease-of-use, scalability, and even organizational problems
4. Security managers see SIEM as magic.
SIEM expectations frequently don't jibe with reality because many IT managers believe SIEM is about as powerful as Merlin's wand.

"A lot of people look at SIEM like it's this magical box -- I get a SIEM and it's going to do all my work for me," says Eric Knapp, vice president of technology marketing for NitroSecurity. "SIEM has different levels of ease of use, but they all come back to looking at information and drawing conclusions. Unless you're looking at it in the correct context for your specific environment, it's not going to help you as much as it should."

Crawford at EMA agrees.

"I think way too many customers have what we would call magical thinking about SIEM and related type of deployments, like log management," Crawford says. "They expect it to collect everything, expect it to be readily integrated with everything, and they expect correlation to be automatic out of the box without even knowing what they're looking for and what their use case is."

Crawford believes organizations need to lay out the priorities of their SIEM deployments and to figure out objectives, such as whether they are just collecting data for reporting or looking to mine historical data before they acquire their SIEM technology.

"Not nearly enough organizations define that well enough to really know what they're looking for in an acquisition," Crawford says. "And then they get into it, particularly if it is expensive or high end, and start realizing what it's really going to involve to deploy and tune it appropriately, and that can overwhelm them."

5. Scalability nightmares continue to reign.
Crawford's advice is doing that advanced homework is especially important prior to buying a SIEM because, depending on your use case, you could need a level of data analysis scalability that your first vendor may or may not be able to handle.

"Frankly, we get a lot of our projects from our competitors not doing a good enough job with scalability and data analysis," Gottlieb says, explaining that customers frequently come to him following a previously failed SIEM deployment. "Most of the deals we go into come as a result of broadened ambition and/or scope for this category and the current provider can't handle it."

According to Knapp, the more dependent organizations become on networked information and on correlated information, the more data that will flood the SIEM. While some SIEM vendors have told their customers that it is just a matter of "tuning" the tool and ignoring "irrelevant" information, others believe the industry needs to do a better job building tools that can scale so that seemingly irrelevant information that might point to a large-scale trend is not lost.

"If we're throwing away what we view as unimportant, then we'll never find the bigger patterns," Knapp says. "You have to have the ability to look at everything."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.