Cyber Defense Centre

The reports of targeted hacker attacks and data theft has become a norm- on a large scale. There are numerous such reports to substantiate that the attackers are usually not lone perpetrators; but professionally organized. There is also a division of tasks such as programming malware, sending e-mails, specifically searching for security exploits or providing exploit kits. State sponsored hacking groups are also increasingly attacking not only other state organizations, but also private enterprises – and all of this using almost unlimited resources. That is why enterprises must become even more professional regarding cyber security – and must not only build higher and higher ICT security walls but also build resilience. New security approaches are needed, in which the focus is on detection and the response to attacks is an essential part of the IT processes. If implemented skillfully, prevention can be improved in a targeted and continuous manner. SOC is seen as a crucial development in the area of ​​cyber security in order to counter the increasingly complex, sophisticated attacks. Though every second enterprise state that they run a SOC it is not clear what does a SOC actually do. The focus is primarily on the central monitoring of IT resources and data, the search for signs of attacks and the management of responses to breaches. A SOC can thus be thought of as a “command deck”; and indeed many security operation centers look like this. In this way, cyber attacks are guarded off. In many enterprises, the SOC also has to take care of monitoring security events, which often neglects the detection of attacks, the analysis and the reaction to incidents. So if the objective is to answer help desk queries, the chances of a successful cyber attack are relatively good from an attacker’s perspective.