Author: Pandu Umaro
As we enter 2022, the Covid-19 virus continues to mutate and so too does the increasing danger of cyber-attack. With so many people spending more time online while working from home, a cyber pandemic has been triggered in the form of data leaks, identity theft, and malware attacks.
This threat has impacted the whole world, including Indonesia; a country where the number of internet users continues to increase every year. In 2021, this online population reached 202 million users, all of whom are exposed to danger in cyberspace.
Data from the National Cyber and Crypto Agency (BSSN) states that on average there are 7-10 million threats on the internet every day, which infiltrate ministries, institutions and companies in Indonesia. BSSN data also shows that in 2021 there were a total of 994,581,569 cases of cyber-attacks in Indonesia.
In 2022, these trends are expected to continue. There are two threats in particular that must be monitored by the Information Technology (IT) sector, namely cyber risk and data privacy risk. This covers everything from cyber vulnerabilities, ransomware and data management, to information technology and digital transformation, among others.
Naturally, and in light of these various cyber security issues, there is an increasing need for privacy, protection and cyber data security. For business activities to continue operating safely, organizations will have to fast track the adoption of digital technology. This will require greater awareness from organizational leaders, especially in terms of the management and prevention of cyber-attack.
Corporations must implement safety measures to ensure cyber privacy and the security of data. When a corporation has adequate security and processes in place and is supported by a robust team, this can certainly help to reduce the negative impacts resulting from exposure to a cyber-attack.
Bearing in mind the complexities of online space, the term “no system is safe” rings true. However, a strict and sustainable security system can dramatically mitigate the risks involved, especially by combatting illegal digital activities. Whether in hacking attacks or malware – such as viruses, spyware, trojans and others – digital threats are growing, both in number and in complexity.
To guard against these increasingly sophisticated threats, network owners must pay careful attention to their security methods. To achieve optimal network security and guard against possible attacks, it is essential to have transparency across all aspects of the network. This can be resolved by integrating the Security Operation Center (SOC).
This SOC system can correlate the information collected from various existing network security solutions, then analyzes security incidents as they unfold.
SOC is a command center designed to monitor the information systems used by companies within their IT infrastructure. It can thereby cover everything – from the business web, databases and servers, to applications, networks, desktops, data centers and a multitude of other endpoints. SOC is one of the central supporting pillars of information security and technology in a business.
Three main factors go into building a SOC: people, process and technology. To achieve optimal efficacy, these three components must be balanced in support of each other and be fully integrated with the SOC. Of course, this is easier said than done – many challenges must be faced along the way.
A fully formed SOC is not only responsible for developing security strategies and carrying out defensive actions or measures; this team will also detect, analyze and respond to security incidents. The SOC can also handle additional responsibilities, such as forensic analysis, cryptanalysis, and reverse engineering.
The SOC works to help alleviate a company’s security challenges by constantly conducting the monitoring process. This is key to maximizing visibility. The SOC implements a tool that scans corporate networks, looking for and finding anything suspicious.
Next, the system-generated alerts will be checked. The goal is to prevent wasting IT team time or unnecessarily interrupting employee workflows and management processes. The SOC bears responsibility for checking all alerts, filtering out false positives that can waste time and resources without due cause.
Once a threat has been identified, the SOC acts as a critical first response unit. It will handle problems immediately and effectively, taking appropriate action to protect the network and its users.
After the prevention process is carried out, the SOC will restore and re-run the corporate IT systems it handles, through a process of recovery and remediation. This takes time, as it involves recovering lost data or checking data that may have been hacked.
Last but not least, there is Log Management. Activity logs contain a lot of useful information about the system, including anything that may have infiltrated it. Therefore, SOC must collect, maintain and review these logs carefully. In the log, you can see a baseline snapshot of the system in a healthy condition. If two logs are compared side by side, a threat may be revealed in cases where the second log differs from the baseline snapshot.
The increasing need for security has created several challenges for companies, especially with the shortage of cybersecurity skills. This lack of experts in the field of cybersecurity leads to a shortage of staff in the SOC, which ultimately makes the team ineffective. This condition harms companies, resulting in an increased risk of occurrence.
Similarly, in cases where there are too many alerts, the system becomes clogged and cannot run effectively. Many of these alerts are often found to be false positives, representing a waste of time and energy. Another issue relates to operational costs – or operational overheads – whereby the process is not integrated, causing security operations to become inefficient. This ultimately leads to wasted money due to excessive operating costs.
No less important is the need to avoid making mistakes. For example, an incident response team could randomly adopt policies based on incomplete information about the company’s cybersecurity profile, without fully exploring and understanding all the facts. This knee-jerk response can endanger the companies they work with.
Digiserve offers effective protection for a company’s sensitive business data, bridging the gap created by limited human resources in cyber security. One of many services provided by Digiserve is Security Intelligence; a cyber-security service solution, which improves the digital security of corporate assets, and maximizes return on investment to cybersecurity.
Based on existing evidence, this solution focuses on insights as well as incidents. Security Intelligence can provide mechanisms, indications, implications, and recommendations that can be applied to overcome threats to company assets.
There are four main elements: the ability to safely maintain company assets, comprehensive solutions with effective management, support from experts, and an integrated structure.
The key advantage of solutions offered by Digiserve is the SOC, with its comprehensive suite of services related to security intelligence. Each of these is designed to increase business productivity, through improvements to infrastructure, business applications, and data protection. Ultimately, this frees companies to focus on their main area of business.
The SOC provides full visibility of possible attacks around the network, by compiling extensive information from all network security solutions operated by the company. In addition, the platform also analyzes ongoing cyber-attacks and provides automatic alerts in response to any security incidents.