Evolution of a SOC/CERT operation

Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Uwe Schröter, EON, Evolution of a SOC and CERT operation Perfect.

Thank you very much, Uwe, for this great presentation. Do we have a question from the audience as we have six minutes left for this track?

Otherwise, I have something from the app users. First question is regarding the time frame. You mentioned you're currently in phase three. End of this year, you achieved it on a certain level. How long did the whole journey take? When did you start with that? The journey, it's quite a while. It's more than a decade. I joined EON around 10 years ago. I wasn't part of the initial switching on the light journey. I would say we're talking about around 15 years when we really said, okay, now is the need to have a deeper look to the security.

Before that, we were more in the situation that several teams, several more IT-related teams had also a security head. Then we said, okay, now we really need to focus this to cover the threats. Perfect. This really shows how much time this needs. I'm personally really interested in having a presentation of you next year when you have experience and was co-pilot for security more or less. Really appreciate if you then will talk again. Maybe going more in the direction of recommending people first step. Taking EON, you learned a lot. You said something around what a decade, 15 years around.

If a company is today in phase one or phase two, somewhere in between, what would you recommend those organizations as a first step? Maybe co-pilot for security is some comparable product the right way or what would you say? My opinion, the most important part here would be getting in the driver's seat. What I try to explain, when you have a service provider and who is doing stuff for you and you don't have the full visibility, that's always really hard to know how secure are you really? What are the gaps? What are the priorities for you to work on?

You pretty soon leave the level of technical discussion, pretty soon just talk about contract details and so on. In my opinion, this is really the most important thing, to have the full visibility about your environment and also about your security tools. When you have this visibility, then you can really start with a new operation model or with new technology to cover everything which is required for the next steps. Isn't that one of the biggest challenges then, to know all of your security assets within your organization?

Yeah, for sure. I mean, we all know more or less about the crown jewels, but probably there's much more, some testing environment, some stuff in the cloud here, something there where you don't have, where you don't apply your security measures and even it's not connected to your SOC or something like that.

That is, I think, the threat, isn't it? Yeah, for sure. And here I think harmonization is key. So this is not really in the control of the security team, at least not for us, but this is really the key. So when we start the journey and there was a historically grown network, it was more or less impossible to cover all the different techniques to just understand what's there.

But I think with the cloudification, and if we would do cloudification in the right way, then there would be a great chance to get more in a harmonized way and to really focus to specific areas where you can then dig deep into the security topics. Perfect.

Then, again, thank you very much, Uwe, for this great presentation.