A Security Operation and Event Management (SOEM) Platform for Critical Infrastructures Protection
Source abstract
Abstract
Industrial Control Systems (ICS) in Operational Technology (OT) environments face unique cybersecurity challenges due to legacy systems, critical operational needs, and incompatibility with standard IT security practices. To address these challenges, this paper presents the Security Operation and Event Management (SOEM) platform, a software designed to support Security Operations Centers (SOCs) in reaching full visibility of OT environments. SOEM integrates diverse log sources and intrusion detection systems, including logs generated by the control system itself and additional on-the-shelf products, to enhance situational awareness and enable rapid incident response. The pilot project was carried out within the funded project SOC-OT-IGE from the “Centro di Competenza Start 4.0” and is being developed in partnership with Ansaldo Energia and HWG Sababa. The validation has been conducted in a real-world pilot project. Thanks to the mapping to requirements for compliance with IEC 62443, the platform demonstrates its effectiveness through defined key performance indicators (KPIs). This work bridges the gap between IT-centric SOC methodologies and the specialized needs of industrial cybersecurity.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Information and Cyber Security · Smart Grid Security and Resilience
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (23)
Show source-provided references
1. Security information and event management (SIEM): analysis, trends, and usage in critical infrastructures10.3390/s21144759 ↗
2. Analysis, trends, and utilization of security information and event management (SIEM) in critical Infrastructures
3. Security operations center: a systematic study and open challenges10.1109/ACCESS.2020.3045514 ↗
4. Strategies for real-time simulation of central solenoid ITER power supply digital twin10.3390/en16135107 ↗
5. Annex III. ICS security related standards, guidelines and policy documents [Internet]. [cited 2023 Nov 2]. Available from: https://www.enisa.europa.eu/publications/annex-iii.
6. Cybersecurity situational awareness taxonomy
7. The operational role of security information and event management systems10.1109/MSP.2014.103 ↗
8. An empirical assessment of endpoint detection and response systems against advanced persistent threats attack vectors10.3390/jcp1030021 ↗
9. Endpoint detection & response: a malware identification solution
10. Adversarial machine learning for network intrusion detection systems: a comprehensive survey10.1109/COMST.2022.3233793 ↗
11. Gartner glossary terms [Internet]. [cited 2023 Oct 31]. Available from: https://www.gartner.com/en/glossary/all-terms.
12. Integrating OT data in SIEM platforms: an energy utility perspective
13. Subramanian · Practical splunk search processing language: a guide for mastering SPL commands for maximum efficiency and outcome · 2020 · 1
14. Bristow · A sans 2021 survey: OT/ICS cybersecurity · 2021
15. A framework for the deployment of cybersecurity monitoring tools in the industrial environment10.1109/MITP.2024.3396356 ↗
16. Toward a security operation center for operational technology in industrial networks
17. Elastic. The heart of the Elastic Stack [Internet]. [cited 2024 Oct 31]. Available from: https://www.elastic.co/elasticsearch.
18. Elastic. Discover, iterate, and resolve with ES—QL on Kibana [Internet]. [cited 2024 Oct 31]. Available from: https://www.elastic.co/kibana.
19. Radiflow. iSID Visibility, Anomaly Detection [Internet]. [cited 2024 Oct 31]. Available from: https://www.radiflow.com/products/ot-visibility-and-anomaly-detection/.
20. Tenable. Tenable one [Internet]. [cited 2024 Oct 31]. Available from: https://www.tenable.com/products/tenable-one.
21. Txone. EdgeIPS [Internet]. [cited 2024 Oct 31]. Available from: https://www.txone.com/products/network-defense/edgeips.
22. Txone. Stellar [Internet]. [cited 2024 Oct 31]. Available from: https://www.txone.com/products/endpoint-protection/stellar/.
23. AIrFIELD Security. WatchField [Internet]. [cited 2024 Oct 31]. Available from: https://www.airfieldsecurity.it/en/solutions/.