SIEM, UBA, UEBA... If you're suffering netsec acronym overload, then here's our handy guide

Is there a difference and does it matter?

Comment In a little more than 20 years, what quaintly used to be called "network security" has gone from simple firewalling and VLANs to talk of analytics driven by self-learning machine intelligence and AI. How should we make sense of such a dramatic jump?

The engine of change has been cybercrime and its remarkable ability to render the advances of successive generations of security technology almost as quickly as they have established themselves. Firewalls were the first to be challenged, overwhelmed by the sheer size and complexity of what they were being asked to monitor. Intrusion detection systems (IDS), intrusion prevention systems (IPS), and various layers of endpoint and device security, once seen as a clever way to make threat-hunting more focused, soon followed.

Ironically, what caused the problem was not that firewalls, IDS, IPS, and endpoint software couldn’t detect cyber attacks, but that the alerts they produced started to overwhelm the defenders with data. With volumes rising, and newer generations of kit adding the monitoring of accounts, applications, privileges, and users to the mix, vendors rushed to solve the problem with expert systems that that could present this mass of event data in a way that allowed humans to separate the good from the bad, and in a digestible manner.

SIEM’s ascent

Throughout the 2000s, security information management (SIM), security event management (SEM), and their later combination in security information and event management (SIEM) was the logical answer to data overload. Instead of managing log data using proprietary systems, SIEM made it possible to use a single overview into which many sources could be gathered and processed for correlations. Although SIEM has become a helpmate few would be without – security operations centers (SOCs) and centralized security monitoring would struggle without SIEM to perform log monitoring – it’s always been about totting up the pros and cons:

• The data from diverse security events can be correlated in a way that would be somewhere between time consuming and impossible using logs from individual systems. If something suspicious is detected, security systems can be instructed to block it.
• Anomalies – defined as violations of policy – stand out clearly in the present and historically.
• Most SIEMS will come with reporting interfaces to help with compliance and auditing, for example PCI DSS and HIPAA.

SIEMs also have limitations, starting with the act they are only as good as the log events being fed and the way these are correlated using rules to generate alerts that point to meaningful events. In principle, good rules should spot unusual events. However, doing so without swamping teams in false positives turns out to be trickier than the marketing brochures let on.

Obviously building and maintaining these rules (or adjusting templates that come with the SIEM) is complex as is the process of normalizing log input to take account of the different data formats used by monitoring systems. Given that these formats and the inputs captured in logs changes and expands over time, this can become onerous.

UBA and the return of the user

The growth of data being fed into SIEMs, the complexity of its management, and doubts about their ability to detect attacks in realtime without overwhelming security teams in alerts eventually has led to a hunt for a new silver bullet. Interest in what Gartner calls user behavior analytics (UBA) followed.

This seemed to highlight the concern that crunching data from network detectors was a losing game when the most important dimension had always been the user. UBA’s innovation was to dispense with the guesswork about what log events meant, or how they could be related to one another, and just focus on a baseline state for users and their credentials. If a user event breached this known state – which could be internal as well as external – this would generate an alert.

Newer generations of firewall have been adding user management to their controls in the mid-2000s, but for organizations investing in SOCs and SIEM it always made more sense to unify this under a system above an individual monitoring device. In some cases, UBA was implemented as an extension to SIEM, or as a capability within the SIEM, as vendors sought to develop their products to suit the market.