Security Information and Event Management (SIEM) is a key concept to identify security threats and mitigate their malicious impact. Traditional SIEM deployment occurs within a corporate infrastructure.
Where an SIEM service is provided by an external service provider, it is also generally the case that SIEM deployment is within the realm of the provider organization and that events only pass via internal customer
or service provider links. However, the Infrastructure as a Service (IaaS) model is driving a complete re- think of the paradigm whereby organizations deploy and manage their own infrastructure for many aspects
of their computing needs. This drive also implies a need to consider the implications for deployment of SIEM in the cloud. Following this trend, organizations could avoid Capex investments to deploy their own
analysis modules, through contracting an Opex based SIEM service based on a .xed or variable monthly fee.

Through this likely shift of SIEM service provision, from stand-alone organizational environments to a shared cloud processing facility, there are opportunities to make inter-organisational analyses. This in itself
raises many issues in terms of ensuring privacy and integrity of the events of any particular company, while still gaining the bene.t of being able to spot cross-company trends. The security of a cloud based service is also critical, and a likely stepping stone towards Public based services is that Private cloud services, from reputable large service providers, will be the preferred deployment model. In this mode, service providers
have full oversight and control over event processing, while customers bene.t from a lower cost, on-demand, scalable service.

Another very important upcoming trend to be addressed in Future Internet and IoT SIEM, is the use of meshed wireless communication to connect cyber-physical systems to critical infrastructures and to the
Internet as a whole. This large scale connectivity, not only of sensors but also of actuators, enables totally new types of remote attacks against critical services and infrastructures with potentially very high impact
and Societal cost.

Furthermore, by its very nature the SIEM itself is a potential target for an attacker (for example to intercept or block SIEM event feeds), so an Internet based SIEM cloud type service would have to provide quality of service guarantees to ensure reliable and timeous arrival of security event information from the sensors. The debate on Internet net-neutrality could also refer here since there could be a case for expediting control traffic such as SIEM event feeds.

The project MASSIF (MAnagement of Security information and events in Service InFrastructures ), a large-scale integrating project co-funded by the European Commission, addresses these challenges. The
vision of creating a next-generation Security Incident and Event Management environment drives the development of an architecture which provides for trustworthy and resilient collection of security events
from source systems, processes and applications. A number of novel inspection and analysis techniques are applied to the events collected to provide high-level situational security awareness, not only on the network level but also on the service level where high-level threats such as money laundering appear. An anticipatory impact analysis will predict the outcome of threats and mitigation strategies and thus enable proactive and dynamic response. The balance between the amount of processing, normalization, aggregation and analysis at edge collectors of an SIEM system, and the work done at the central nerve centre are also topics which would have to be re-considered in the context of an Internet type deployment of an SIEM system. A scalable distribution of acquisition and parallel processing, and seamless function-splitting between core engines and edge collectors, is needed.

In essence though, the evolving Internet provides many new questions for SIEM deployment, and from an SIEM perspective reinforces the importance of having an Internet with security and possibly di.erentiated
service for high priority and trustworthy control tra.c such as the events from an SIEM. The commercial models also change since a service fee needs to evolve to scale up/scale down pay-per-use models.