At this year’s Infiltrate Security Conference in Miami, John Grigg walked the audience through a common target network where a known and commonly used SIEM had been integrated in order to show participants how to exploit onto the SIEM, find intel, and cover their tracks.
Though SIEM technologies are supposed to help secure the networks, Grigg said that they are often misconfigured, which creates more vulnerabilities.
Even though some of the legacy tools are pretty cool, Grigg said the problem is that no one really knows the platform that well. “The vendor who built it knows it from a design standpoint. Then there’s the re-selllers, the guys who install it, the internal IT guys who inherit the systems, but they tend to never really focus on it.”