Examining the return on investment of a security information and event management solution in a notional Department of Defense network environment
Loading...
Authors
Warnecke, Matthew P.
Subjects
Security Information and Event Management
Security Event Correlation
Incident Response
Return on Investment
Return on Security Investment
Return on Security
Network Intrusion
Security Event Correlation
Incident Response
Return on Investment
Return on Security Investment
Return on Security
Network Intrusion
Advisors
Housel, Thomas J.
Mun, Johnathan C.
Date of Issue
2013-06
Date
Jun-13
Publisher
Monterey, California: Naval Postgraduate School
Language
Abstract
Sophisticated cyber threats represent a significant adversary in the evolving world of the cyber domain. Furthermore, determining whether or not an attack has taken place and the extent of the damage caused requires significant resources. In order to guarantee reliable detection, prevention and mitigation of these advanced threats, the Department of Defense (DoD) must invest in advanced information security technologies that increase the defensive capabilities of its information networks. This thesis focuses on Security Information and Event Management (SIEM) systems as an enabling technology that possesses the advanced security capabilities required to address sophisticated, evolving cyber threats. The research explores the capabilities of this technology in terms of the speed of detection, depth of investigative power, and additional value provided. Additionally, this research attempts to quantify the return on investment that a SIEM solution could provide when deployed in a notional DoD network architecture. Ultimately, the research provided in this thesis endeavors to justify DoD investment in SIEM technology. The focus of this research revolves around a qualitative description of the inherent capabilities of SIEM products and utilizes several Return on Security Investment models in an attempt to quantitatively define the value of these capabilities in a DoD network.
Type
Thesis
Description
Series/Report No
Department
Information Sciences (IS)
Organization
Identifiers
NPS Report Number
Sponsors
Funder
Format
Citation
Distribution Statement
Approved for public release; distribution is unlimited.
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.