PAGE Blog Business Weekly Magazine
The cyber security is still a challenging and diverse field and it has been evolving due to constant technology transformation and enhancement as per changing business environments, needs and practices. In the earlier stage of protecting IT systems or digital assets, primary focus was on ‘perimeter security defense’ against outside threats as lots of capital and investment was made on perimeter controls like firewalls, intrusion detection systems, proxy servers, etc. to avoid the cyber criminals. Recognizing that perimeter defense alone is insufficient, now ‘layered defense’ is being adapted to confront insider threats as well because nowadays and in future most destructive security threats are not only originating from malware or malicious outsiders but from both malicious and negligent insiders.
Nowadays, the Cyber Security Operation Center (CSOC) is emerging as a dominant and critical operation for any type of automated and risk-aware institutions and playing a vital role in layered and perimeter security defense for the protection of an institution’s critical automated infrastructure and systems. The CSOC work with a goal to prevent, monitor, detect, analyze, respond and report cyber threats and attacks proactively. A good and mature CSOC is one that supports business objectives, functions and effectively improves an institution risk posture effectively and diligently over time. A real and active CSOC is one that provides a secure environment for the business to deliver on its core objectives in line with its strategic direction and vision.
Like Information Technology Operation Center (ITOC) or Network Operation Center (NOC), which is focused on continuous performance monitoring of IT infrastructure and systems, the CSOC has emerged as the active security defense and command center and continuous security monitoring mission and critical security platform for any type of business automation and acting as first front end line of defense to handle and respond against emerging cyber threats through a centralized repository of Security Information and Event Management System, which is referred to as the cyber security nerve center or core cyber security system of CSOC.
A well-functioning CSOC can form the heart of security intelligence and monitoring capability through effective detection of security events, breaches, attacks and incidents in the institution’s IT environment. It can empower cyber security function towards security insight and visibility, situational awareness, faster response, risk aversion, working more collaboratively and sharing knowledge more effectively.
A well-defined and comprehensive CSOC can enhance an institution’s ability to proactively detect, prevent and respond to security threats, attacks and incidents. Given the rapidly evolving digital landscape and nature of threats, technologies used in CSOCs should be scalable and interoperable to ensure effective and efficient operations. The process should be designed with stakeholder accountability and communications and associated mechanisms should be defined as part of the processes.
Last but not the least, we must act and work together consistently with conducive efforts to reduce our business, people, processes and technology vulnerabilities and risks against emerging cyber threats landscape before they can be exploited to damage or distress and ensure that such disturbances of cyberspace are infrequent, of minimal duration, manageable and make the least damage possible in the best interest and protection of cyber space systems supporting our country’s critical infrastructures like banking and finance, defense, telecommunications, power grids, dams and irrigation, oil and gas and healthcare etc. that is essential to our people, economy, security and way of life.
