SIEM 환경에서 정량적 위험평가를 위한 사고 탐지모델

Abstract

As the business environment changes, cybercrime technology continues to evolve and defenses become more difficult. SIEM, which is an emerging technology to cope with advanced cyber attacks, collects and stores logs in identification range based on big data processing technology and provides a comprehensive defense system in terms of information protection through correlation analysis. Recently, companies have introduced this technology to integrate various security solutions and try to carry out information protection activity for the organization based on the collected information, but it is leading to the failure or limited use of the operation. This leads to the question of what to do with the SIEM system. It is the main duty of the information security task in the enterprise and it is described in ISO 27005 as detailed risk management procedure. In this paper, we study how to construct SIEM in terms of information security risk management. We describe the method of risk assessment by asset based on collected logs and show the development process of SIEM detection rule applying it