97 Things Every Information Security Professional Should Know

Chapter 70. Threat Modeling for SIEM Alerts

Phil Swaim

As security professionals in a security operations center (SOC), there are a great range of alerts that will be available to you. Antivirus, firewalls, intrusion detection and prevention systems (IDS/IPS), identity and access management (IAM), data loss prevention (DLP), and many other tools and systems will generate alerts that may or may not be helpful to your SOC in determining if an adverse event has occurred.

Overlogging and overenabling these alerts could result in high false-positive rates, which end up distracting the SOC from possible real threats in the environment getting through.

So what to do? Threat model your alerts!

Identify a target of interest in your environment you wish to defend from adversaries. Draw it or write its name on the right side of a chart. Leave some room on the right for later. This could be data, a process, or even a person in your organization.

Identify interested adversaries, such as hacktivists, nation states, cybercriminals, or insider threats, and place them on the left of the chart in separate rows. You will find that some adversaries prefer to use different initial vectors.

Identify likely initial vectors and list those by adversary to the right of the adversary list. A targeted phish, an insider using USB, and drive-by malware downloads are some examples.

Identify points of lateral ...