Security information management

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages)

This article is missing information about the purpose of the collected data and how it is used. The article could also benefit from additional context on how it relates to Information security. Please expand the article to include this information. Further details may exist on the talk page. (May 2018)

|

(Learn how and when to remove this template message)

Security information management (SIM) is an information security industry term for the collection of data such as log files into a central repository for trend analysis.[1]

## Contents

* 1 Overview
* 2 Terminology
* 3 Regulatory compliance
* 4 See also
* 5 References

## Overview

SIM products generally are software agents running on the computer systems that are monitored. The recorded log information is then sent to a centralized server that acts as a "security console". The console typically displays reports, charts, and graphs of that information, often in real time. Some software agents can incorporate local filters to reduce and manipulate the data that they send to the server, although typically from a forensic point of view you would collect all audit and accounting logs to ensure you can recreate a security incident.[2]

The security console is monitored by an administrator who reviews the consolidated information and takes action in response to any alerts issued.[3][4]

The data that is sent to the server to be correlated and analyzed are normalized by the software agents into a common form, usually XML. Those data are then aggregated in order to reduce their overall size.[3][4]

## Terminology

The terminology can easily be mistaken as a reference to the whole aspect of protecting one's infrastructure from any computer security breach. Due to historic reasons of terminology evolution; SIM refers to just the part of information security which consists of discovery of 'bad behavior' or policy violations by using data collection techniques.[5] The term commonly used to represent an entire security infrastructure that protects an environment is commonly called information security management (InfoSec).

Security information management is also referred to as log management and is different from SEM (security event management), but makes up a portion of a SIEM (security information and event management) solution.[6]

## Regulatory compliance

Security information management systems support compliance with regulatory frameworks that require centralized collection and analysis of security data. The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires covered entities to implement audit controls that record and examine activity in information systems containing electronic protected health information (45 CFR 164.312(b))."45 CFR § 164.312 - Technical safeguards". Legal Information Institute. https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C. SIM platforms aggregate these audit records to support the required regular review of information system activity records (45 CFR 164.308(a)(1)(ii)(D)).

The December 2024 HIPAA Security Rule NPRM proposed requiring regulated entities to deploy automated systems capable of monitoring and recording access to ePHI, including the ability to detect unauthorized access attempts in near real-time."HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information". Federal Register. January 6, 2025. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information. The Payment Card Industry Data Security Standard (PCI DSS) similarly requires centralized log management and daily review of security events (Requirements 10.4 and 10.6)."PCI DSS v4.0". PCI Security Standards Council. March 2022. https://docs-prv.pcisecuritystandards.org/PCI DSS/Standard/PCI-DSS-v4_0.pdf. NIST Special Publication 800-53 addresses security information management through the AU (Audit and Accountability) control family, which specifies requirements for audit event generation, content, storage, and analysis."NIST SP 800-53 Rev. 5: Security and Privacy Controls". National Institute of Standards and Technology. September 2020. https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final.

## See also

* Information security
* Information security management
* Information security management system
* Security Information and Event Management
* Security event manager
* Gordon–Loeb model for cyber security investments

## References

1. ↑ J.L. Bayuk (2007). Stepping Through the InfoSec Program. ISACA. p. 97.
2. ↑ Kelley, Diana (March 2004). "Report: Security Management Convergence via SIM (Security Information Management)—A Requirements Perspective" (in en). Journal of Network and Systems Management 12 (1): 137–144. doi:10.1023/B:JONS.0000015702.05980.d2. ISSN 1064-7570. http://link.springer.com/10.1023/B:JONS.0000015702.05980.d2.
3. ↑ 3.0 3.1 John Wylder (2004). Strategic Information Security. CRC Press. p. 172. ISBN 9780849320415.
4. ↑ 4.0 4.1 Cyrus Peikari and Anton Chuvakin (2004). Security Warrior. O'Reilly. pp. 421-422. ISBN 9780596552398. https://books.google.com/books?id=LILroPpCP0cC&q=Security+Warrior. Retrieved 17 January 2014.
5. ↑ Kelley, Diana (2004-03-01). "Security Management Convergence via SIM (Security Information Management)—A Requirements Perspective.". Journal of Network & Systems Management 12 (1): 137–144. doi:10.1023/B:JONS.0000015702.05980.d2. ISSN 1064-7570.
6. ↑ http://www.siem.su/ SIEM Analytics (in Russian)

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Security information management. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Security_information_management&oldid=4297920"