The UK’s Ministry of Defence (MoD) has successfully deployed an upgraded security information and event management (SIEM) and analytics platform for its Defence Cyber Operations (DCO) team.
The new service is being delivered by IT services house Centerprise, which is overseeing commercial delivery, support, enablement and governance, and Elastic, which will take on the core SIEM capabilities – with the intent of ensuring the MoD’s cyber operators can get up and running quickly and without fuss.
“DCO deserves a platform that can grow with the scale of the challenge. Together with Elastic, we are building that capability while ensuring the MoD has the support to use it effectively from day one,” said Centerprise director of defence and security, Mark Brady.
“Our structured governance and enablement approach ensures the MoD achieves maximum value and long-term resilience from this platform.”
Faith Bateman, regional vice president of public sector at Elastic, added: “The MoD’s continued investment in cyber defence reflects its commitment to staying ahead of an increasingly complex hybrid threat environment, where adversaries operate across cyber, information and physical domains simultaneously.
“Through our work with DCO and Centerprise, we are enabling analysts to maintain a common operational picture across the entire environment, centralising data to accelerate detection and mission response, and allowing analysts to focus on high-priority threats,” said Bateman.
Traditional SIEM not up to the job
The core challenge facing the MoD’s new partners arose from the fact that its globally-distributed military and ancillary workforce demands its networks must not only be constantly available but able to handle large volumes of extremely sensitive traffic, often relating to intelligence or military operations
The MoD had found that more traditional SIEM platforms were unable to keep pace with the ever more sophisticated cyber threats faced by a department of its nature. Historically, this led to visibility gaps and rendered its incident responders slower and less effective. Lacking strong governance and enablement meant even more advanced tools could never live up to their potential.
According to Centerprise and Elastic, the new, refined programme equips DCO with a “defence-ready” SIEM capability that will deliver more unified visibility, streamlined operations, and faster incident detection and response.
Some of the system’s public features include expanded visibility across the MoD’s networks to let cyber operators spot and contain malicious activity before it becomes a problem, and easier to follow workflows to ensure cyber responders can work quicker and ensure incidents don’t disrupt core military missions.
Meanwhile, structured training and oversight will hopefully help the MoD ensure its new platform is able to adapt as the threat landscape continues to evolve
The system’s resilience is underpinned by a tiered support model via which Elastic will take responsibility for providing advanced technical expertise, while Centerprise looks after orchestration, escalation and governance.
Hybrid warfare
The MoD’s latest deployment comes amid a growing threat from hybrid cyber-kinetic military operations targeting European states, which some authorities believe is in danger of spilling over into open war, likely against Russia.
In such a scenario, the true threat to the UK’s security would likely come not as it did during the Second World War – from a Nazi ground invasion – but from the kind of tactics used in Ukraine, such as electronic warfare and cyber attacks on digital infrastructure and communications networks, food suppliers, government bodies and utilities.
In his annual speech assessing the threats facing the UK, delivered earlier this week, MI5 chief Ken McCallum spoke of a “generational shift” in national security and spoke of how artificial intelligence (AI) in particular is “supercharging the cyber security contest”.
