Page 189 - Cyber Defense eMagazine August 2024

underperforming in their primary function: namely, cyberthreat detection. According to the study,
a staggering 82% of enterprises believe their SIEM tools are not meeting expectations when it
comes to identifying and responding to threats in a timely manner.

The underperformance of SIEM systems is not just a minor hiccup; it represents a substantial
risk to enterprise security. SIEMs are expected to be the sentinels of an organisation’s digital
security, monitoring events from various sources to detect unusual activities and potential
breaches. When these systems fail, it means threats can linger undetected, allowing adversaries
ample time to inflict substantial damage.

Understanding the Shortcomings

But why are such crucial tools are falling short?

There are several reasons behind the underperformance of SIEM systems:

Complexity and Misconfiguration: SIEM solutions are inherently complex, often requiring meticulous
tuning and configuration to function optimally. Misconfigurations can lead to false positives and missed
detections, as highlighted in the CardinalOps report, where over 70% of surveyed organisations admitted
to facing configuration challenges.

Data Overload: SIEMs are bombarded with vast amounts of data from diverse sources. Without proper
filtering and prioritisation, this data deluge can overwhelm the system, leading to missed alerts or delayed
responses.
Skill Gaps: The effective operation of SIEM tools requires skilled personnel who can interpret the data
and adjust the systems as needed. As the cybersecurity industry is currently facing a talent shortage,
with an estimated 3.5 million unfilled positions globally, this exacerbates the problem.

Integration Issues: Many organisations struggle with integrating SIEM tools with their existing
infrastructure and other security tools. Lack of seamless integration can obstruct the SIEM’s ability to
provide a comprehensive view of the threat landscape.

Embracing Imperfections and a New Perspective on SIEM

In a thought-provoking piece by security expert Anton Chuvakin the inherent flaws of SIEM
systems are examined and he argues for a different perspective. He suggests that rather than
viewing SIEM flaws as failures, organisations should embrace these imperfections as
opportunities for re-evaluation.

The importance of continuous improvement and iterative development in SIEM shouldn’t be
overlooked and requires a proactive approach where organisations regularly assess, align and

Cyber Defense eMagazine – August 2024 Edition 189
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.