Utilizing Cyber Security Kill Chain model to improve SIEM capabilities
P. Toropainen · Theseus (Ammattikorkeakoulujen) · 2020
In the current cyber threat situation, it is vital for an organization to be able to keep up to date cyber situational awareness (cyber SA) and detect the intrusion attempts. The everchanging cyber security threat situation forces organizations to deploy and utilize new tools and techniques to detect and react to events taking place in their environment. Security Information & Event Management (SIEM) is one of these systems that can be used to produce the cyber SA and detect those adversary events. Cyber SA and Cyber Security Kill Chains were studied from the standpoint of developing SIEM system capabilities. One of the most important concepts was the SIEM use case used to describe the added value of the SIEM use case and its technical details. The objective was to create a novel construct that could be utilized in developing and managing SIEM use cases throughout its lifecycle and to help in directing the development efforts towards to the most needed sections of the environment. Constructive research approach was utilized while researching problems arising from work life and trying to produce a novel construct to solve these problems. The produced construct was implemented, and the achieved results were analyzed with qualitative means. A set of interviews was held with the involved parties to get a wider view of the achieved results. By utilizing the SIEM use case concepts and with the proposed construct, answers to the research questions were received, and it was discovered that the proposed construct provides the desired structure and methods to create and maintain SIEM use cases.