SIEM and General Data Protection Regulation (GDPR)

General Data Protection Regulation (GDPR) was approved by EU Parliament on April 14, 2016 and its enforcement date is marked on May 25, 2018. Any organization not compliant to GDPR will face heavy fines.

GDPR Overview

•    Objective

The EU General Data Protection Regulation (GDPR) is set to replace the Data Protection Directive 95/46/EC. It was designed for data privacy across Europe. The aim of GDPR is to protect all EU citizens from privacy and data breaches. It applies to all companies processing the personal data of data subjects residing in the Union, regardless of the company's location.

• Penalties

Breach of GDPR can be fined up to 4% annual global turnover of Euro 20 million (whichever is greater). It is to be noted that this is the maximum fine that can be imposed for the most serious infringements.

Serious infringement? 

It include not having sufficient customer consent to process data or violating the core of Privacy by Design concepts.

However, there is a tiered approach to fines. For example a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment.

It is important to note that these rules apply to both controllers and processors -- meaning 'clouds' will not be exempt from GDPR enforcement.

• Data Subject Rights

Breach Notification

Under the GDPR, breach notification will become mandatory in all member states where a data breach is likely to “result in a risk for the rights and freedoms of individuals”.

Notification: within 72 hours of first having become aware of the breach.

Right to Access

Right for data subjects to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what purpose. Further, the controller shall provide a copy of the personal data, free of charge, in an electronic format.

Right to be Forgotten

The right to be forgotten entitles the data subject to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data.

Data Portability

GDPR introduces data portability - the right for a data subject to receive the personal data concerning them, which they have previously provided in a 'commonly use and machine readable format' and have the right to transmit that data to another controller.

Privacy by Design

Privacy by design calls for the inclusion of data protection from the onset of the designing of systems, rather than an addition.

Data Protection Officers

Must be appointed on the basis of professional qualities and, in particular, expert knowledge on data protection law and practices

May be a staff member or an external service provider

Contact details must be provided to the relevant DPA

Must be provided with appropriate resources to carry out their tasks and maintain their expert knowledge

Must report directly to the highest level of management

Must not carry out any other tasks that could results in a conflict of interest.​

How to monitor GDPR using SIEM?

Now the thing is, you may be using SIEM solution for monitoring all events. The question to ponder upon is, how to ensure timely notification of any events that might indicate breach or matter of concern? Things to monitor can be summarized as below

Overview of you system in General

1. All active user objects
2. All deactivated user objects
3. All Organizational Units
4. All groups and group Policies
5. What are the types of devices you use? like: directory devices, active devices, microsoft devices, non-microsoft, domain controllers, deactivated devices, active servers etc
6. Active directory group types. like global group, universal group etc.

Details of User Activities in Active Directory

1. Members added and removed from groups
2. User who is responsible for any changes that occurs in your infrastructure
3. Affected classes and attributes
4. All successful and failed Authentication using different devices
5. Successful and failed network access
6. Locked and unlocked users statistics
7. Failed authenticated users and their reasons
8. Any update (change, add, delete etc) to your infrastructure. audit, authentication, authorization policy changes

Details of File System Activities

1. Who accessed what files and folders. Successful and failed file access?
2. Who accessed critical files and folders?
3. Who copied what files to cloud application like Dropbox, Google Drive, OneDrive etc.?
4. Who copied what files to removable storage (USB devices)?

Details of Mobile Devices and Activities

1. What kind of mobile devices are being used and by who
2. Is user trying to ActiveSync any files/datas? What is the status of ActiveSync
3. What is the statistics of successful and failed authentication?

Details of Location of your data

• Where are your data located internationally and nationally?

Details of Database Activities

• Types of databases in your organization
• What are the types of actions in databases?
• Users involved in database activities
• Was access and action authorized?

NIST 800-171 Compliance - Access Control

"Almost all physical and logical entry points to the organization and its information system need some type of access control"

Access Controls specifies following four:

• which users can access a system or facility
• what resources those users can access
• what operations those users can perform
• Enforce accountability for those users' actions

Access control is the process of allowing only authorized users, programs, or other computer systems (i.e. networks) to observe, modify, or otherwise take possession of the resources of a computer system. It is also a mechanism for limiting the use of some resources to authorized users.

In short, access controls are the collection of mechanisms, processes, or techniques that work together to protect the assets of an organization. They help protect against threats and mitigate vulnerabilities by reducing exposure to unauthorized activities and providing access to information and systems to only authorized people, processes, or systems.

Access controls incorporates all operational levels of an organizations:

• Facilities: Protects entry to, and movement around, organization's physical location. This protects personnel, equipment, information and other assets inside that facility.
• Support Systems: Systems like power, heating, ventilation, AC, fire suppression controls must be carefully controlled.
• Information Systems: Multilayer of access controls needs to be applied in information systems and networks. This protect those systems from harm or misuse.
• Personnel: Ensure right people have access right access and they do not interfere with people with whom they do not have any legitimate business.

NIST 800-171

A guideline from NIST provides following security requirements for access control (including basic and derived requirements) for protecting the confidentiality of CUI (Controlled Unclassified Information) in nonfederal information systems and organizations. The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.

Basic Security Requirements:

• 3.1.1  Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
• 3.1.2  Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Derived Security Requirements:

• 3.1.3  Control the flow of CUI in accordance with approved authorizations.
• 3.1.4  Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
• 3.1.5  Employ the principle of least privilege, including for specific security functions and privileged accounts.
• 3.1.6  Use non-privileged accounts or roles when accessing nonsecurity functions.
• 3.1.7  Prevent non-privileged users from executing privileged functions and audit the execution of such functions.
• 3.1.8  Limit unsuccessful logon attempts.
• 3.1.9  Provide privacy and security notices consistent with applicable CUI rules.
• 3.1.10  Use session lock with pattern-hiding displays to prevent access/viewing of data after period of inactivity.
• 3.1.11  Terminate (automatically) a user session after a defined condition.
• 3.1.12  Monitor and control remote access sessions.
• 3.1.13  Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
• 3.1.14  Route remote access via managed access control points.
• 3.1.15  Authorize remote execution of privileged commands and remote access to security-relevant information.
• 3.1.16  Authorize wireless access prior to allowing such connections.
• 3.1.17  Protect wireless access using authentication and encryption.
• 3.1.18  Control connection of mobile devices.
• 3.1.19  Encrypt CUI on mobile devices.
• 3.1.20  Verify and control/limit connections to and use of external information systems.
• 3.1.21  Limit use of organizational portable storage devices on external information systems.
• 3.1.22  Control information posted or processed on publicly accessible information systems.

SIEM and Compliance

Keeping up with compliance and reporting is a daunting tasks. SIEM solutions can help us here by providing holistic visibility into the network and improving detection and response capabilities. However, not everything mentioned by NIST is realizable through SIEM. Here's what you can implement with your SIEM to create a compliance reporting.

Basic Security Requirements:

3.1.1  Limit information system access to authorized users and process.

• Check user authentication and their actions. Source and destination of authentication

Derived Security Requirements:

3.1.5  Principle of least privilege

• Track activities by privileged accounts

3.1.6  Use non-privileged accounts or roles

• Privilege authentication by user, source, destination, application etc.

3.1.7  Prevent non-privileged users from executing privileged functions and audit the execution of such functions.

• Check for privilege escalation and associated events

3.1.8  Limit unsuccessful logon attempts.

• Account lockout, failed logins, failed privileged logins, 3+ failed login within 1 minute, failed login from multiple location etc.

3.1.12  Monitor remote access sessions.

• Remote login, vpn sessions by users. Summary and Time-trend analysis

3.1.18  Control connection of mobile devices.

• track mobile device usage and users

Log Source Requirements

• Hosts Logs (Windows, Unix etc.)

UEBA and SIEM

User and Entity Behavior Analytics (UEBA) as name suggests provides behavioral analytics of user and other entities using different learning algorithms. It is vital for UEBA to get data from different log sources to perform its analysis and provide result.

Security Incident and Event Management (SIEM) in essence collects, stores and monitors logs from different devices.

This means UEBA and SIEM are closely related. One collects and stores logs while other require centrally collected logs to provide output. Also, if you look into Gartner's vision of next-generation SIEM solution, UEBA should be the built-in functionality in SIEM. Advanced analytics and user monitoring (baselining and advanced analytics to analyze access and authentication data, establish user context and report on suspicious behavior.) are two fundamental capabilities SIEM should posses. Thus, UEBA and SIEM goes hand-in-hand.

Comprehensive Guide to SIEM