Factory Security Operation Center (FSOC)

IDS and Edge server need to be installed in factory premise. Factory network packets are mirrored by switch and flow into these devices.

When anomaly packets is included in factory network packets, IDS issues an alert. IoT SIEM manage logs only and security expert conduct analysis by using raw packet from the edge server.

How alert to incident response been handled by this service:

1. IoT SIEM receive anomaly alert and manage it, 24/7 team of expert conducts primary analysis and makes phone calls to Japan.

2. Security Expert monitor conducts secondary analysis and makes phone call to PISCAP. Then PISCAP makes phone calls to Factory.

3. PSC continues analysis by using raw packets from Edge Server with providing information of situation. During detail analysis, PISCAP and Factory have communication with each other.

4. Finally detail analysis is completed, PSC and PISCAP have conference call and PSC provide detail information.

5. PISCAP conduct incident response if needed. It's the same routine in IT case.

6. Then Factory person makes reports to Factory management.

7. Finally, Factory management makes judgement that on whether operations should be stop or not.