<\/span><\/h3>\n\n\n\nNetwork management<\/em> Sysem is a generic term to define tools are used to monitor and control IT systems<\/em>. In the IDMEFv2 environment it designates essentially tools monitoring availability and performance of hardware and software <\/p>\n\n\n\n<\/span>IODEF : Incident Object Definition Exchange Format<\/span><\/h3>\n\n\n\nThe Incident Object Description Exchange Format (IODEF) defines a data representation that provides a framework for sharing information commonly exchanged by Computer Security Incident Response Teams (CSIRTs) about computer security incidents.<\/p>\n\n\n\n
<\/span>IoT : Internet of Things<\/span><\/h3>\n\n\n\nThe Internet of things (IoT) describes physical objects (or groups of such objects) with sensors, processing ability, software and other technologies that connect and exchange data with other devices and systems over the Internet or other communications networks (e.g. LAN)<\/p>\n\n\n\n
Example :<\/p>\n\n\n\n
\n- camera, badger, drone,<\/li>\n<\/ul>\n\n\n\n
<\/span>IIoT : Industrial Internet of Things<\/span><\/h3>\n\n\n\nThe industrial (IIoT) refers to the extension and use of the internet of things (IoT) in industrial sectors and applications. The IIoT encompasses industrial applications, including robotics, medical devices, and software-defined production processes.<\/p>\n\n\n\n
<\/span>Operator<\/span><\/h3>\n\n\n\nThe operator is the first person being notified of an alert. Usually he works in front of the manager GUI but can also receive the alert through mail or sms. The role of the operator is to identify if the alert needs an action, if this action is already known and documented or if there is a need for further analysis through possible escalation toward the analyst team. Operators are often called “First Level Support”.
The operator is in direct contact with the IDMEFv2 alert and will mostly use the information contained in the alert to take it’s decision. But the operator has also access to other informations , like raw logs for example. Thus IDMEFv2 alerts should not try to include all the information available but enough “pointers”\/”indications” for the operator to go get this additional information.<\/p>\n\n\n\n
<\/span>PTI : Physical Threat Intelligence<\/span><\/h3>\n\n\n\n(Physical) Threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes.
PTI can concern human (e.g. activist, thief, intruder,\u2026), human activities (e.g. attack, sabotage, bombing, polution,\u2026) as well as natural hazard (e.g. storm, heat wave, flood, wildfire, \u2026)<\/p>\n\n\n\n
<\/span>PSIM : Physical Security Information Management<\/span><\/h3>\n\n\n\nA category of software that provides a platform and applications designed to integrate multiple unconnected security applications and devices and control them through one comprehensive user interface. It collects and correlates events from existing disparate security devices and information systems (video, access control, sensors, analytics, networks, building systems, etc.) to empower personnel to identify and proactively resolve situations.
PSIM for short, is a solution that helps organizations detect, analyze, and respond to (physical) security threats before they harm business operations.
PSIMs are “physical” equivalent of SIEMs<\/p>\n\n\n\n
<\/span>SIEM : Security Information & Event Management<\/span><\/h3>\n\n\n\nSecurity information and event management (SIEM) is a field within the field of computer security, where software products and services combine security information management (SIM) and security event management (SEM). SIEM provide real-time analysis of security alerts generated by applications and network hardware. Thus SIEM are cyber-security oriented. These products are also used to log security data and generate reports for compliance purposes and possibly for incident management.
SIEM for short, is a solution that helps organizations detect, analyze, and respond to (cyber) security threats before they harm business operations.<\/p>\n\n\n\n
<\/span>Security policy<\/span><\/h3>\n\n\n\nA security policy is a document that states in writing how an organisation plans to protect its physical and information technology (IT) assets. Security policies are living documents that are continuously updated and changing as technologies, vulnerabilities and security requirements change. The basic purpose of a security policy is to protect people and information, set the rules for expected behaviors by users, define, and authorize the consequences of violation.
Concerning Incident Detection, the security policy should define what should be considered as an incident for the organisation and what action should be taken to solve it.<\/p>\n\n\n\n