TY  - JOUR
AU  - Caviglia, Roberto
AU  - Aliaskharov, Daniyar
AU  - Aceti, Alessio
AU  - Dalla Preda, Mila
AU  - Girdinio, Paola
AU  - Gaggero, Giovanni Battista
PY  - 2025
TI  - A Security Operation and Event Management (SOEM) Platform for Critical Infrastructures Protection
JO  - Computers, Materials & Continua
SN  - 1546-2218
SP  - 5327
EP  - 5340
VL  - 85
IS  - 3
AB  - Industrial Control Systems (ICS) in Operational Technology (OT) environments face unique cybersecurity challenges due to legacy systems, critical operational needs, and incompatibility with standard IT security practices. To address these challenges, this paper presents the Security Operation and Event Management (SOEM) platform, a software designed to support Security Operations Centers (SOCs) in reaching full visibility of OT environments. SOEM integrates diverse log sources and intrusion detection systems, including logs generated by the control system itself and additional on-the-shelf products, to enhance situational awareness and enable rapid incident response. The pilot project was carried out within the funded project SOC-OT-IGE from the “Centro di Competenza Start 4.0” and is being developed in partnership with Ansaldo Energia and HWG Sababa. The validation has been conducted in a real-world pilot project. Thanks to the mapping to requirements for compliance with IEC 62443, the platform demonstrates its effectiveness through defined key performance indicators (KPIs). This work bridges the gap between IT-centric SOC methodologies and the specialized needs of industrial cybersecurity.
UR  - https://doi.org/10.32604/cmc.2025.068509
DO  - 10.32604/cmc.2025.068509