Expert support for difficult security framework adaptation

In recent years, cyberattacks have become more sophisticated, and it is said that it is impossible to completely prevent attackers from intruding or infringing. In such a situation, prompt incident response is required, and security measures based on log analysis (detection/correlation rules/alert management/analysis, etc.) using SIEM are one of the most important measures that corporate security departments should consider. is.

In order to effectively utilize SIEM as the core of security measures, it is essential to effectively design detection rules according to the purpose and advance design for log management and analysis operation linked to it. Effective methods for design include security frameworks such as the security standards published by various organizations, the MITER ATT&CK framework, and CIS Controls®. Utilizing the framework comprehensively and effectively covers the security risks faced by companies and the methods of attackers based on the knowledge of experts and experts. and design can be considered. On the other hand, since it is highly specialized and difficult to understand, general user companies need to acquire security skills and knowledge to fully utilize it, and it will take some time to make effective use of it. .

In this service, experts who are proficient in all security domains, SIEM, and Splunk support the design of security measures centered on SIEM through collation analysis with the MITER ATT&CK framework. This will help customers who wish to improve the level of security measures to implement countermeasures using the framework.

Gap analysis with security framework
~Risk analysis by experts + detection rules to deal with risks~

Our service proceeds as follows. At every step, experts familiar with all elements of security and SIEM respond, making it possible to provide high-quality suggestions and recommendations in a short period of time.

The assessment of this service utilizes the MITER ATT&CK framework to assess the status of security measures in the customer's environment in comparison with the latest risks and attacker techniques. After that, we design "detection rules" that supplement the major risks and major gaps extracted as the assessment results (up to 10 rules). The assessment can be completed in a short period of about two weeks using a templated pre-interview sheet.

特徴① パッケージ化により低価格・短期間を実現

Regular security domain consulting takes at least 3 months or more and costs tens of millions of yen, so many customers find it difficult to request it. This service realizes short-term and low-cost security consulting through simplification and packaging.

Security and SIEM experts will respond, embodying GAP analysis with the MITER ATT&CK framework and recommended SIEM countermeasures at a high level, while emphasizing ease of use for customers that can be realized in a short period of time and at a low price. .

Feature 2: Assessment using the MITER ATT&CK framework

The MTIRE ATT&CK framework is a systematization of the flow and methods of cyberattacks by MITER, a well-known non-profit organization that implements CVE numbering, and is used by enterprise companies to consider security measures. It is designed to give "specific and exhaustive suggestions" that are useful in practice.

As shown in the figure below, the horizontal axis shows the attacker's tactics, and the vertical axis shows the attacker's techniques (technologies used). It is a framework that can be covered.

Based on the knowledge of experts and experts, it comprehensively and effectively covers the security risks faced by companies and the techniques used by attackers. becomes possible.

Feature 3: Consistency from framework adaptation to setting level

One of the features of our consulting services is that we can consistently support everything from the design of security concepts (guidelines/framework, etc.) to the SIEM design/configuration/implementation layers.

General security consulting provided by other companies supports the design of guidelines and monitoring policies. Most of the time it is requested. However, it is difficult for most of our customers to put the high-level concepts into solution specifications and adapt them to actual operations on site, which requires a great deal of time and effort, and is difficult to achieve in a short period of time.

In the security consulting service we provide, we present recommendations in a concrete form, from security frameworks and standards assessments to Splunk SIEM configuration proposals and specification levels. This is made possible by the support of members who are well versed in security, SIEM, and Splunk. In addition, if necessary, it is also possible to substitute for implementation work and maintenance work by using another service.

Cost, period, etc.

cost	From 9 million yen (excluding tax)
period	about 10 weeks
type of contract	Quasi-delegation contract
Contractor	Customer -Macnica (some work is subcontracted to partner companies)
Artifact	Provision of assessment report (Word document format) (1) Analysis result report (2) Recommended SIEM use cases ③ SIEM use case design

Contact Us

045-476-2010
月～金 8：45～17：30

inquiry
Please feel free to contact us

Free seminar
Click here for various seminars

Document download
Click here for various materials