INTEGRATION OF AUTOMATED SOLUTIONS INTO THE INFORMATION SECURITY MANAGEMENT SYSTEM BASED ON THE APPLICATION OF SIEM TECHNOLOGIES

Abstract

The theoretical, scientific-methodological and organizational-functional foundations of the use of SIEM systems in information security management are considered. Modern approaches to information security management and incident investigation are determined. Methodological approaches to the formation of the concept of the function-ing of SIEM systems in information security management are presented. The stages of solving the scientific and practi-cal problem associated with increasing the level of security of information systems using SIEM systems in information security management are proposed. In modern conditions of rapid development of digital technologies and global digi-talization, the issue of ensuring information security is becoming particularly relevant. Every year, the number of cyber threats is increasing, becoming more complex, coordinated and targeted, which, in turn, creates new challenges for enterprises, government agencies and the private sector. In this context, the formation of an effective information secu-rity management system (ISMS) is not only a technical but also a strategic necessity for any organization. An ISMS, built in accordance with international standards, in particular ISO/IEC 27001, provides a holistic risk management policy, controls access to critical information assets and allows you to form a security culture in the organizational environment. At the same time, traditional approaches to organizing information security are increasingly proving to be insufficiently effective in the conditions of a dynamic threat landscape. One of the main problems is the fragmentation of protection measures, which leads to the loss of a holistic picture of security events in the organization. Delays in responding to incidents, caused mainly by manual processing of information, as well as risks associated with the human factor (errors, bias, oversights), significantly reduce the effectiveness of the protection system. Therefore, there is a growing need to integrate automated solutions that are able to ensure timely detection, analysis and response to cyber threats with minimal human involvement. In this context, SIEM technologies (Security Information and Event Manage-ment) are becoming increasingly widespread, combining the functionality of collecting, normalizing, correlating and analyzing information security events with the ability to detect anomalies and automated response to incidents. The integration of SIEM into the information security management system allows you to create a single information and analytical center that provides continuous monitoring and control of the security status in real time. The purpose of the article is to study the possibilities of integrating automated solutions based on SIEM technologies into the ISMS, taking into account current challenges, practical aspects of implementation and potential advantages of such an approach. The study analyzed the architectural and functional features of SIEM systems, determined their role in reducing the impact of the human factor and accelerating the processes of detecting and responding to incidents, and also consid-ered the prospects for further development of SIEM in combination with artificial intelligence technologies and auto-mated SOAR (Security Orchestration, Automation and Response) platforms. The article is aimed at revealing the inno-vative potential of automation in the field of information security and substantiating the feasibility of implementing such solutions in organizations of various scales.