SIEM-less security; Panacea or placebo

SIEM-less security; Panacea or placebo

Speakers: Simon, Incident Response Specialist

Conference: CrikeyCon

YouTube: https://www.youtube.com/watch?v=3QxOAE6qwUA

Overview

In his CrikeyCon talk, "SIEM-less security; Panacea or placebo," Simon (@simbo) delivers a provocative and insightful critique of the traditional Security Information and Event Management (SIEM) paradigm. Drawing from eight years of experience in incident response and uplifting SOC maturity, Simon challenges the industry's reliance on monolithic SIEM platforms, arguing that they often fail to deliver on their promises, leading to budget overruns, operational fatigue, and a false sense of security. The talk advocates for a fundamental shift in perspective: viewing SIEM not as a technology product, but as a capability that an organization must achieve.

Simon's central thesis is that security teams should move beyond the "tick-box" mentality of acquiring a SIEM platform simply because it's marketed as essential or mandated by compliance frameworks. Instead, he proposes a decoupled SIEM or system of systems approach. This strategy emphasizes leveraging the inherent strengths of existing security tools, strategically managing data, and investing in the skills of security personnel to build agile, customized solutions that directly address an organization's specific risk profile and security strategy. The discussion is particularly relevant for organizations struggling with the cost, complexity, and efficacy of their current SIEM deployments, offering a compelling alternative that prioritizes strategic thinking over technology acquisition.

Background

▶ Watch: Introduction, speaker background, and talk agenda (0:00)

The concept of a SIEM emerged around 2005 when Gartner coined the term, merging Security Information Management (SIM) and Security Event Management (SEM). The initial goal was to centralize log management and event data, making it easier to investigate security incidents. This evolved into SIEM 2.0 around 2011-2012, focusing on scalability to handle increasing data volumes, improved analytics beyond signature-based detections, and enhanced APIs for broader data access, alongside the introduction of workflows. By SIEM 3.0, the focus shifted to cloud-based, hyper-available, and super-scalable platforms, promising infinite data storage, advanced automation, and the nascent integration of machine learning and partner-developed connectors for seamless integration.

Currently, we are on the cusp of SIEM 4.0, heavily influenced by the emergence of AI models and Large Language Models (LLMs), which vendors promise will automate detection and remediation to unprecedented levels. However, Simon argues that throughout this evolution, the core drivers for SIEM adoption have remained largely superficial:

1. Compliance: Organizations purchase SIEMs to tick regulatory boxes (e.g., PCI DSS, ISO 27001), despite standards rarely specifying a particular technology, merely a capability for centralized logging and event management. Simon recounts working in a PCI-compliant environment with four siloed SIEMs, generating over a thousand unmanageable alerts daily, highlighting the disconnect between compliance and actual security posture.
2. Customer Expectation: Supplier questionnaires often inquire about SIEM technology, leading organizations to adopt solutions based on perceived industry standards rather than genuine need or effective utilization.
3. Security Perception: The belief that "everyone else has one" and marketing hype drives adoption, fostering a perception that a SIEM is a universal panacea.

Simon defines security events as indicators of activity or failure, and security information as supporting data for investigation and control monitoring. Management, simply put, is the control and organization of these elements. The promise of SIEM was to unify these, but the reality often falls short. A key issue highlighted is the pervasive duplication of capabilities across the security technology ecosystem. Modern Endpoint Detection and Response (XDR), firewalls, and SaaS applications all generate alerts, offer prioritization, enrichment, storage, search, notifications, and even workflows. The SIEM, intended as a central hub, often becomes another siloed system duplicating these functions, leading to complexity, maintenance overhead, and budget fatigue. Simon illustrates this by showing how alerts, ranking, audit trails, storage, search, notifications, and workflows are handled by multiple systems, not just the SIEM, creating redundancy and inefficiency. This redundancy often leads to the failure of the "single pane of glass" ideal, as teams are constantly battling integration challenges, data mapping issues, and agent updates that disrupt operations. Simon shared an anecdote where a project to build a robust SIEM capability was derailed by a "free" vendor solution that quickly spiraled into significant hidden costs, exceeding previous years' budgets.

Key Findings

▶ Watch: Demonstrating duplicated capabilities across security tools (9:05)

Simon's talk culminates in several critical findings that challenge the status quo of security operations:

• SIEM is a Capability, Not a Technology: The most fundamental finding is that regulatory standards like ISO 27001 and PCI DSS do not mandate a specific SIEM product. Instead, they require the capability to manage security events and information effectively. This distinction liberates organizations from feeling obligated to purchase a monolithic SIEM and encourages a focus on achieving security outcomes through appropriate means.
• Traditional Monolithic SIEMs are Niche, Not the Norm: Simon asserts that the vision of a single, all-encompassing SIEM platform storing and analyzing all data is a niche case, not the appropriate norm for most organizations. These large systems are often too costly, complex, and rigid to adapt to diverse business contexts and evolving threat landscapes.
• The "Decoupled SIEM" or "System of Systems" Approach is the Future: Gartner's recent buzzword, the decoupled SIEM, aligns perfectly with Simon's long-held belief and his mentor's concept of a "system of systems." This approach advocates for leveraging the individual strengths of various security tools within an architecture, rather than forcing all capabilities into one vendor's platform. It's akin to a service-oriented architecture (SOA), where specialized components work together.
• Strategic Data Management is Paramount: A significant cost driver for traditional SIEMs is data ingestion and storage. Simon argues against pushing all data into a costly SIEM platform simply because "we may need it one day." Instead, data ingestion should be driven by specific detection models and use cases within defined timeframes. Data required for long-term compliance or infrequent investigations can be stored in cheaper, colder storage tiers, significantly reducing operational expenses.
• Investment in People and Agility Outweighs Platform Lock-in: Rather than training security teams solely on vendor-specific SIEM platforms, organizations should invest in fundamental skills like Python and Regex. This empowers teams to build, integrate, and orchestrate solutions, fostering an agile security architecture that can rapidly adapt to changing risks and technology trends without being beholden to a single technology partner's roadmap or slow connector development cycles.

Technical Deep Dive

▶ Watch: SIM is a capability, not a technology: revisit strategy (16:00)

The evolution of SIEM platforms, as detailed by Simon, provides crucial context for understanding their current limitations. SIEM 2.0 brought scalability, analytics, and APIs, moving beyond basic log aggregation. SIEM 3.0 introduced cloud-native architectures, promising hyper-availability and unlimited scalability, along with nascent machine learning capabilities and partner-developed connectors. However, these connectors often lag behind technology changes, leading to delays in data mapping updates (e.g., three months or more after a vendor changes their data schema). SIEM 4.0 is now grappling with the integration of advanced AI models and Large Language Models (LLMs), aiming for autonomous threat detection and remediation.

Simon critically examines the architectural redundancy prevalent in many organizations. He illustrates a typical security stack including host protection (e.g., XDR), network protection (firewalls, IDS), SaaS applications, a SIEM, and a task management system. He then maps common security functions across these components:

• Alert Creation: Generated by host, network, SaaS, and SIEM.
• Prioritization: Handled by host, network, SaaS, SIEM, and task management.
• Enrichment/Note Taking: Available in host, network, SaaS, and SIEM.
• Storage: Data is stored across all these systems.
• Search/Correlation: All systems offer some level of search, with SIEM specializing in cross-source correlation.
• Notifications: All systems can generate notifications.
• Workflow: Many systems now include automation workflows.

This pervasive duplication highlights how a SIEM, rather than unifying, often becomes another layer of complexity. The core technical argument for a "SIEM-less" or decoupled SIEM approach, also termed a "system of systems," is rooted in Service-Oriented Architecture (SOA) principles. Instead of a single monolithic platform, an organization should architect a collection of specialized capabilities. This means:

• Leveraging Best-of-Breed Tools: Utilize the inherent strengths of each security tool. For instance, an XDR solution is best for endpoint telemetry and initial alerts, while a firewall excels at network traffic logging.
• Selective Data Ingestion: Not all data needs to reside in a high-cost, real-time analytics platform. Data should be ingested into a SIEM-like analytics layer only if there's a specific, defined detection model or use case requiring immediate correlation. For compliance or long-term forensic needs, cheaper cold storage solutions are more appropriate, avoiding the prohibitive costs of "hot" SIEM storage. Simon points out that if an organization is regularly looking at 12-24 months of hot data, it likely indicates deeper control issues rather than effective security operations.
• Orchestration, Not Just SOAR: While Security Orchestration, Automation, and Response (SOAR) platforms can provide orchestration, Simon advises investing in general orchestration capabilities. A dedicated SOAR can inadvertently become another monolithic "security flavor" SIEM. A more agile approach involves building orchestration layers using scripting languages (like Python) and automation tools that can integrate disparate systems via their APIs, allowing for flexible responses to evolving threats and organizational changes.
• AI for Integration: Simon suggests that advanced AI, particularly Large Language Models (LLMs), can now expedite the creation of new connectors. Instead of waiting for vendors to develop and update partner connectors, AI tools can quickly analyze technology specifications and generate initial data mapping solutions, significantly accelerating integration efforts and reducing reliance on vendor-specific development cycles. This allows organizations to pivot much faster when new technologies are adopted or existing ones are updated.

By focusing on these principles, organizations gain greater control over their security architecture, reduce vendor lock-in, and can adapt their defenses more rapidly and cost-effectively.

Demo / Proof of Concept

▶ Watch: Gartner's decoupled SIM and system of systems approach (17:30)

This talk was primarily conceptual and analytical, presenting a critical evaluation of traditional SIEM approaches and proposing a strategic shift towards a decoupled, capability-driven security architecture. As such, it did not include a live demonstration or proof of concept of a "SIEM-less" architecture. Simon's presentation focused on theoretical arguments, real-world anecdotes, and strategic recommendations rather than showcasing a specific technical implementation.

Defensive Implications

▶ Watch: Final takeaway: Invest smartly, empower your team (25:00)

Simon's presentation offers profound defensive implications for security practitioners and leaders aiming to optimize their security posture and investments:

• Revisit Security Strategy and Risk Assessment: Defenders must move beyond checkbox compliance and marketing hype. The foundational step is to thoroughly reassess the organization's unique risk profile and security strategy. All investments, including those in logging and event management, should directly align with mitigating identified threats and achieving specific security objectives.
• Embrace a Capability-First Mindset: Shift focus from "buying a SIEM" to "achieving event management and incident response capabilities." This allows for a more flexible and effective approach, where the desired outcome dictates the tooling, rather than the tooling dictating the strategy.
• Adopt a Decoupled, System-of-Systems Architecture: Instead of a single, monolithic SIEM, defenders should architect a security ecosystem that leverages the individual strengths of specialized tools (e.g., EDR for endpoint, cloud-native tools for cloud logs, network firewalls for perimeter). An agile orchestration layer can then integrate these components, allowing for flexible data routing and correlation.
• Implement Smart Data Storage Strategies: Critically evaluate data ingestion into high-cost analytics platforms. Data required for immediate detection and correlation should be "hot," but long-term compliance or forensic data (e.g., 12-24 months) can be moved to cheaper, cold storage tiers. This significantly reduces operational costs without compromising regulatory requirements.
• Invest in Human Capital and Core Skills: Prioritize training security teams in fundamental, transferable skills such as Python for scripting and automation, and Regex for pattern matching and data extraction. This empowers analysts and engineers to build custom integrations, develop tailored detection logic, and adapt the security architecture to evolving needs, reducing reliance on vendor-specific training and proprietary solutions. Empowered teams are more engaged, more effective, and less likely to experience burnout.
• Challenge "Shiny Object Syndrome": Executives and security teams should critically evaluate new security features, modules, or platforms. If a new offering doesn't directly address a defined risk or strategic objective identified by the governance or risk assessment teams, it should be questioned. Avoid adopting new technology simply because it's marketed as the "next big thing" or has appealing dashboards.
• Prioritize Agility and Control: By building a more agile, orchestrated environment, organizations gain greater control over their security direction. They can pivot faster in response to new threats, changes in organizational structure, or shifts in technology trends, rather than being constrained by a technology partner's roadmap or slow development cycles.

Key Takeaways

• SIEM is a Capability, Not a Product: Organizations should focus on achieving security event and information management capabilities as required by standards, rather than simply acquiring a specific technology labeled "SIEM."
• Monolithic SIEMs are Often Inefficient: Traditional, all-encompassing SIEM platforms are frequently costly, complex, and lead to operational fatigue due to duplicated functionalities, constant maintenance, and budget overruns.
• Embrace a Decoupled "System of Systems": A more effective approach involves leveraging the strengths of individual security tools (XDR, firewalls, cloud logs) and integrating them through an agile orchestration layer.
• Strategic Data Management is Crucial: Optimize data storage by ingesting only necessary data into high-cost analytics platforms for active detection. Utilize cheaper cold storage for long-term compliance and infrequent investigations.
• Invest in Your Team's Core Skills: Empower security professionals by training them in fundamental skills like Python and Regex, enabling them to build, integrate, and adapt solutions, fostering agility and reducing vendor dependency.
• Align Investments with Risk and Strategy: All security technology acquisitions should directly address identified organizational risks and align with the defined security strategy, avoiding purchases driven by marketing or mere compliance checkboxes.

About the Speaker(s)

Simon (@simbo) is an experienced security professional with over eight years in the field. His career has spanned various specializations, including governance, risk management, and development, but his primary focus has been in incident response. He has significant experience working in Security Operations Centers (SOCs), often in organizations recovering from significant security incidents, where his efforts centered on uplifting and maturing their incident response capabilities. Beyond his professional life, Simon is passionate about bouldering and indoor rock climbing, and enjoys making silly voices as a dungeon master.