Incident Response Planning Archives

Security Information and Event Management (SIEM) and Regulated Industries

June 17, 2026 by Daniel Ihonvbere

Understanding SIEM in 2026: Limitations—and How to Build a Compliant, Outcome‑Driven Detection Program

Executive summary. Security Information and Event Management (SIEM) remains central to modern detection and response, but the playing field has evolved: cloud‑first estates, identity‑centric attacks, and new or strengthened rules (CMMC, HIPAA Security Rule enforcement practices, FTC Safeguards updates, ISO/IEC 27001:2022, and NIST CSF 2.0) raise the bar for logging, monitoring, and evidence. SIEM alone isn’t enough; you’ll need smart log source prioritization, detection engineering mapped to frameworks like MITRE ATT&CK, and automation you can trust (SOAR), all tuned to produce defensible evidence for audits and assessments.

What is Security Information and Event Management (SIEM) today (and what it isn’t)

A SIEM centrally collects and analyzes logs and events across systems, networks, applications, identities, and cloud services to help analysts detect, investigate, and report incidents. It’s often paired with Security Orchestration, Automation, and Response or SOAR to orchestrate and automate response actions.

SOAR (security orchestration, automation, and response) provides playbooks and automation for triage and remediation; it does not replace analytic rigor or governance.

Governments and industry recently published pragmatic guidance for implementing SIEM/SOAR, highlighting benefits (visibility, faster response) and pitfalls (data normalization, coverage, resource intensity).

Where SIEM fits in frameworks: NIST CSF 2.0 explicitly expects continuous monitoring and event logging outcomes (e.g., PR.PS‑04 requires that log records are generated and made available for continuous monitoring)—functions typically enabled by SIEM + SOAR.

Information Asset Security and Control: Tailored Strategies for SMBs

August 11, 2024 by Daniel Ihonvbere

Information Asset Security and Control: Best Practices for Small and Medium-Sized Businesses

Information is one of the most valuable assets a business can possess in today’s fast-paced digital world. From customer data to financial records, the information that companies handle is crucial to their operations and success. However, with the rise in cyber threats, information asset security and control has become more critical than ever.

This comprehensive guide will delve into the essentials of information asset security and control, offering practical advice tailored for small and medium-sized businesses (SMBs). We’ll cover the importance of securing information assets, explore common threats, and provide best practices to safeguard your business.

Understanding Information Asset Security

What Are Information Assets?

Information assets include any data, digital files, and knowledge that hold value to your business. These can be customer records, financial information, proprietary software, marketing strategies, and even employee details. For SMBs, the security of these assets is paramount to avoid financial loss, reputational damage, and legal repercussions.

Organizational Documentation in Information Security Auditing

June 23, 2024June 22, 2024 by Daniel Ihonvbere

The Ultimate Guide to Organizational Documentation in Information Security Auditing for Small and Medium-Sized Businesses

In this digital age, information security is paramount for businesses of all sizes, and one of the key components of a strong information security framework is thorough and well-maintained organizational documentation. For small and medium-sized businesses (SMBs), maintaining the integrity, confidentiality, and availability of information is crucial for building trust with clients and partners., and ensuring that organizational documentation is thorough and up-to-date can be a daunting task. However, it’s an essential part of information security auditing that protects your business from cyber threats and regulatory penalties.

In this comprehensive guide, we’ll explore what organizational documentation entails, why it’s crucial for information security audits, and offer best practices tailored to SMBs. By the end of this article, you’ll have a clear understanding of how to improve your documentation process to safeguard your business effectively.

Attack Surface Management: Essential Strategies for Cybersecurity

June 4, 2024 by Daniel Ihonvbere

Understanding Attack Surface Management: Protecting Your Organization from Cyber Threats

In the modern digital landscape, cybersecurity is a top priority for organizations of all sizes. Attack surface management (ASM) has emerged as a crucial component of an effective cybersecurity strategy. Understanding and managing your attack surface can significantly reduce the risk of cyberattacks. This comprehensive guide will walk you through the concepts of threat models, hardening guides, and monitoring, with examples to illustrate these concepts. We will also discuss common challenges organizations face and offer best practices to help you bolster your cybersecurity defenses. Additionally, we will recommend some popular tools to aid in your ASM efforts.

Keywords: Attack Surface Management, Threat Models, Hardening Guides, Cybersecurity, Monitoring, Best Practices, Security Tools

SOAR: Security Orchestration, Automation, and Response

December 21, 2023 by Daniel Ihonvbere

Security Orchestration, Automation, and Response (SOAR) is a security tool that helps organizations detect data breaches and malicious activities by constantly monitoring and analyzing network devices and events. It is a comprehensive security solution that consists of various components working together to provide a seamless security experience.

In this blog post, we will explore the concept of SOAR and its components in detail.

What is SOAR?

SOAR is a security tool that automates the process of detecting and responding to security incidents. It collects alerts from devices all around the organization’s network, collates them centrally, relates alerts to each other, notifies us of suspicious things we need to worry about, and does something about them into the bargain. It is a valuable tool for organizations that want to improve their security posture and reduce the time it takes to respond to security incidents.

Understanding SIEM: Weaknesses and How to Strengthen Your Security

December 14, 2023 by Daniel Ihonvbere

In today’s digital landscape, cybersecurity is a paramount concern for businesses and organizations of all sizes. As cyber threats continue to evolve in complexity and sophistication, it’s crucial to have robust security measures in place. One such security solution that has gained prominence in recent years is the Security Information and Event Management (SIEM) system.

While SIEM is a powerful tool for enhancing cybersecurity, it’s essential to be aware of its weaknesses and understand how to address them effectively.

What is Security Information and Event Management?

SIEM, which stands for Security Information and Event Management, is a comprehensive solution designed to provide real-time analysis of security alerts and events generated throughout an organization’s IT infrastructure. Its primary purpose is to help organizations detect, respond to, and mitigate security threats efficiently.