Security Systems Monitoring
The effectiveness of the monitoring must be ensured in interaction with the business processes.
Increasing complexity – among other things due to the use of new technologies (e.g. IoT solutions) in combination with an often incomplete picture of vulnerabilities as well as their criticality – can lead to significant threat potentials.
Security Systems Monitoring includes the ongoing monitoring of the safety within IT systems. This makes it possible to minimize the attacker’s radius of action quickly and consistently during an attack and to stop the attack.
Using “Security Systems Monitoring”, we continuously integrate all available log sources (e.g. network traffic, active directory, application traffic, server loads) into a consistent central security monitoring unit. Based on this data, we model a typical behavior pattern for each system, depending on external circumstances such as daytime and weekday. By defining appropriate alert definitions and threshold values, unusual behavior of IT systems can be identified as quickly as possible in order to initiate appropriate responses within a short period of time.
By designing a Security Operations Center (SOC) as a central control center, we create a clearly structured and automated overview of the IT security-relevant areas, increase the controllability of operational security processes, and enable proactive identification of potential security gaps.
EFS’s modular system for “Security Systems Monitoring” offers different modules to achieve effective monitoring in our customers’ operations with reasonable effort.
Information requirements
To identify IT security-relevant information, we create a central overview of IT security-relevant information and company areas.
Modules:
- Analyzing the IT security strategy for the coordinated direction of the monitoring concept
- Identifying risks as well as legal, contractual, and organizational framework conditions
- Identification of the necessary information requirements and fields of action
Definition of monitoring system
We define a customized IT Security Monitoring System for our clients, depending on content and organizational level.
Modules:
- Definition of monitoring KPIs, routines and processes
- Setting up the monitoring framework (organizational structures, roles, responsibilities, documentation systems)
- Definition of cooperation and reporting structures
Implementing monitoring system
To implement the IT security monitoring system, we establish the monitoring and appropriate key performance indicators. This guarantees an increased ability to control the operational security processes.
Modules:
- Defining a specific approach for the implementation of the monitoring system
- Selecting suitable data collection and analysis routines as well as analysis tools
- Execution and support with the implementation of the monitoring system
Data measurement & monitoring
For efficient and effective collection of data, we operationalize the continuous monitoring of relevant data, systems, and applications.
Modules:
- Operationalize data collection and measurement according to the monitoring system.
- Execute the procedures to collect and aggregate the measured data
- Implement procedures to process the data
Analysis of measurement results
For the identification of IT security gaps and vulnerabilities, an efficient monitoring of data flows and standard operation takes place, which serve as an indicator of relevant security incidents in the company.
Modules:
- Execution of routines to evaluate and interpret the collected results.
- Identifying gaps between expected and actual results within defined business objectives
- Regular reporting to relevant stakeholders
Effectiveness evaluation
To evaluate the performance of the IT security monitoring system, we use automatisms to assess effectiveness and ensure sustainable performance.
Modules:
- Analyze the sustainable effectiveness of the monitoring system
- Deriving areas of action for optimization regarding performance and effectiveness
- Continuous adjustment of the monitoring system to match the needs of the business processes
