Electronic Theses and Dissertation

Saat ini, perusahaan dari segala sektor industri menyambut kedatangan
teknologi 4.0 seperti Cloud Computing, IoT, Augmented Reality, dan Artificial
Intelligence. Akan tetapi, pemanfaatan teknologi generasi baru ini pada dasarnya
menimbulkan konsekuensi tersendiri bagi keamanan siber. Disini Security Operations
Center (SOC) adalah salah satu komponen pendukung teknologi informasi dalam
sebuah perusahaan yang bekerja melakukan pengamanan cyberspace, pemantauan dan
menganalisa jika terjadi ancaman. Pada penelitian ini akan dilakukan pengujian
Security Onion dalam mendeteksi potensi serangan terhadap akses server berdasarkan
investigasi insiden dengan pendekatan pendekatan 5W 1H, Indicator of Compromise
(IoC) dan melakukan pemetaan serangan dengan Matrik TTP ATT&CK. Penelitian ini
bertujuan untuk menguji fungsionalitas dari Security Onion sebagai utilitas SOC
dalam mendeteksi potensi ancaman serangan terhadap server. Setelah dilakukan
skenario serangan Port Scanning, SQL Injection, DOS, XSS, Brute Force dan CVE2011-2523 didapatkan hasil yakni Security Onion berhasil mendeteksi semua indikasi
serangan yang telah disimulasikan dalam bentuk informasi alert yang ditampilkan
melalui interface web aplikasi Security Onion.
Kata kunci : Security Operating Center (SOC), Security onion, Indicator of
Compromise (IoC), Matrik TTP ATT&CK

Currently, companies from all industrial sectors welcome the arrival of 4.0 technologies such as Cloud Computing, IoT, Augmented Reality, and Artificial Intelligence. However, the use of this new generation of technology basically has its own consequences for cyber security. Here the Security Operations Center (SOC) is one of the supporting components of information technology in a company that works to secure cyberspace, monitor and analyze if a threat occurs. In this study, Security Onion will be tested in detecting potential attacks on server access based on incident investigations with a 5W 1H approach, Indicator of Compromise (IoC) and mapping attacks with ATT&CK TTP Matrix. This study aims to test the functionality of Security Onion as a SOC utility in detecting potential attack threats against servers. After the Port Scanning, SQL Injection, DOS, XSS, Brute Force and CVE-2011- 2523 attack scenarios have been carried out, the results are that Security Onion has successfully detected all indications of a simulated attack in the form of alert information displayed through the Security Onion web application interface. Keywords : Security Operating Center (SOC), Security onion, Indicator of Compromise (IoC), TTP ATT&CK Matrix