Analysis of implementation of a Security Information and Events Management (SIEM) System in Public Business Entities (PBE) hospitals

• Autor(a) principal: Gonçalves, Emanuel de Araújo
• Data de Publicação: 2023
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Texto Completo: http://hdl.handle.net/20.500.11960/3911
• topic: Cyber security; SIEM; Hospital; Threats; Resilience; Cibersegurança; Ameaças; Resiliência

In a general context, IT systems are vulnerable to attacks due to increasing digitalization, especially in the health sector. Therefore, the need to protect these systems is extremely urgent. Organizations are increasingly turning to Security Information and Event Management (SIEM) systems to protect the data they manage through a strategy of centralized analysis of multiple security events originating from different security components. The purpose of this work is to analyze and implement a SIEM system in a hospital environment. To achieve this objective, an exploration of the current state of SIEM systems and their main functions was conducted. An analysis of security needs and specific requirements in the hospital context was also performed. Based on this analysis, an architectural model for implementing the SIEM system in the hospital is proposed. The proposed model was implemented and tested in a laboratory environment, revealing that the SIEM system is capable of identifying and reporting relevant security incidents in a hospital context [27]. Some limitations in the tested system were also identified, along with suggestions for future improvements. Taking into account the recent cyberattacks that have targeted public hospitals in Portugal, hospitals must be prepared to face these threats. Implementing a SIEM system can play a key role in mitigating these attacks and safeguarding sensitive patient and employee information.