20.500.12556/DKUM-76976 Uporaba varnostno operativnega centra za zaščito kritične infrastrukture magistrsko delo Use of the security operations center to protect critical infrastructure Nenehen razvoj tehnologije in kibernetskega prostora vabi podjetja, organizacije in posameznike še k večji uporabnosti. S tem se povečuje tudi število groženj, katerih škodljiva programska oprema postaja čedalje bolj kompleksnejša in odpornejša na odkritje in odstranjevanje, povzročajo pa večje škode. Tudi sami »hekerji« postajajo iznajdljivejši pri samem vdiranju v informacijske sisteme, pri tem pa jih je še težje odkriti, saj uničujejo sledi dejavnosti. Zagotavljanje informacijske in kibernetske varnosti je ključnega pomena predvsem v tistih organizacijah oziroma v podjetjih, kjer so škode lahko nepredstavljive in kjer lahko pride celo do smrtnih žrtev. Ene izmed teh so kritične infrastrukture, kjer varnost dajejo na prvo mesto. Namen magistrske naloge je raziskati varnostno operativni center, ki ga uporabljajo za varnost kritične infrastrukture v Sloveniji. Ugotavljali bomo sestavo in učinkovitost delovanja varnostno operativnega centra v treh različnih kritičnih infrastrukturah, in sicer v elektroenergetskem, telekomunikacijskem ter zdravstvenem sektorju. Z izvedbo intervjujev in analize strokovne literature bomo poskušali pridobiti podatke na zastavljene cilje. Pri sestavi varnostno operativnega centra se bomo osredotočili na zaposlene, strojno in programsko opremo, kjer nas zanima samo SIEM-sistem. Pri učinkovitosti delovanja pa se osredotočamo na samo zagotavljanje varnosti, uspešnost pri varovanju kritične infrastrukture ter pomoči in podporo drugi organizaciji in varnostno operativnih centrov. Za lažje razumevanje delovanja SIEM-sistema bomo predstavili IBM-QRadar. V zadnjem delu magistrske naloge bomo predstavili rezultate intervjujev. Tako bomo na podlagi pridobljenih rezultatov intervjujev in analize strokovne literature, odgovorili na raziskovalna vprašanja. The constant development of technology and cyberspace invites increased usage by companies, organizations and individuals. This also increases the number of threats whose malware is becoming more complex and resistant to detection and removal, while causing more damage. Even the "hackers" themselves are becoming more resourceful in breaking into information systems, they are now harder to detect, as they destroy traces of their activity. Ensuring information and cyber security is crucial, especially in those organizations or companies where any form of attacks could present unimaginable damage or even fatalities. One of these are critical infrastructures, where security comes first. The purpose of the master's thesis is to investigate the security operations center, which is used for the security of critical infrastructure in Slovenia. We will determine the composition and efficiency of the security operations center in three different critical infrastructures, namely in the electro-energetic, telecommunications and health sectors. By conducting interviews and analyzing professional literature, we will try accomplish the goals we have set for the thesis. When compiling the security operations center, we will focus on employees, hardware and software, where we are only interested in the SIEM system. In terms of efficiency, we focus on ensuring security and performance in protecting critical infrastructure, as well as on the assistance and support from other organizations and security operations centers. To make it easier to understand how the SIEM system works, we will present the IBM-QRadar. In the last part of the master's thesis we will present the results of the interviews. Thus, based on the obtained results of interviews and analysis of professional literature, we will answer research questions. kritična infrastruktura varnostno operativni centri grožnje varnost informacijska varnost kibernetska varnost magistrska dela security operation center critical infrastructure threats security true true false [S. Gjergjek] Slovenski jezik Angleški jezik Magistrsko delo/naloga 2020-08-06 07:05:57 2020-09-02 11:26:56 2022-08-09 14:12:04 2020-09-03 03:18:07 2020 0 Ljubljana 2020 Ljubljana VI, 68 str. 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 004.056:351.863(043.2) 26913539 URN:SI:UM:DK:U0HWYV7D MAG_Gjergjek_Saso_2020.pdf MAG_Gjergjek_Saso_2020.pdf 1 F35F0FB80109F86A1581BDCEA4D8443F be6e9589598eb2a3e7a945cab38476efdf29d7b7d16bb366fe91ded0409fed77 71bf5f65-7c11-11eb-bb7a-00155d0001ca 20.500.12556/dkum/b85d0b34-e1ee-414e-a774-0dff33882ef4 https://dk.um.si/Dokument.php?lang=slv&id=144079 Fakulteta za varnostne vede 0 0 0