Computer Attack Monitoring and Incident Management Center

The main articles are:

• Situational centers (definition, main tasks)
• Security Information and Event Management (SIEM)

2015: Launch of Computer Attack Monitoring and Incident Management Center

On October 7, 2015, Perspective Monitoring announced the commissioning and provision of services for the Center for Computer Attack Monitoring and Incident Management (CM).

The official presentation of the service will be held as part of the SOC forum, in Moscow on November 11, 2015.

Screenshot of the operational monitoring window (2015)

The monitoring center is a complex of hardware and software. It is served by more than 30 highly qualified specialists. The complex is based on an event collection and processing system developed by the company based on international standards. The shift on duty processes tens of thousands of events per day, formalizes suspicions of incidents, transfers them to the work of analysts and researchers who identify computer attacks.

Screenshot of the software window (2015)

The Monitoring Center monitors publications in open sources and the media about the identified vulnerabilities in software components. At the same time, the customer receives up-to-date information on the level of security of his information systems, as well as recommendations for response.

Signature development for IDS is highlighted in a separate direction. Specialists of the Monitoring Center test all updates of the database of free ETOpen signatures on a specialized stand and identify, correct or exclude non-working or incorrect rules, add their own. Every month, the company issues about 100 unique rules that take into account the Russian specifics of attacks and at the same time comply with international standards, which have a detailed description in three languages.

Screenshot of the Incident Management Window (2015)

The monitoring center began work in 2014, serving five organizations with branches in Russia and abroad, in test mode. During this period of time, 150 million events were processed, 86 information security events and 24 incidents were identified. The Monitoring Center team continuously monitored publications about vulnerabilities in four software products and confirmed information about the presence of more than 600 vulnerabilities in 146 components. Through continuous analysis of malicious traffic and software, about 500 rules have been written for intrusion detection systems.

"In the last two years alone, the number of information leaks around the world has doubled, which allows us to talk about the constantly increasing intensity and scale of computer attacks," said Vladimir Klimenko, General Director of Promising Monitoring. - In such conditions, the operation of IPS only and even regular information security audits cannot guarantee the protection of critical data. Many companies have already come to understand the need to use intrusion detection systems and form monitoring services. Most organizations cannot independently deploy such centers: this requires significant financial costs and high competence of service personnel. However, incident monitoring and management services can be obtained from a security provider, which is our company's role. "