Belajar Security Analyst - Compliance & Reporting
Mempelajari framework compliance NIST ISO SOC2, security metrics & KPIs, dan cara membuat reporting yang efektif untuk management
#Pendahuluan
Setelah di episode 19 kita mempelajari identity & access monitoring, pada episode ini kita dalami compliance & reporting — memahami framework compliance, mengukur security posture, dan melaporkan hasilnya ke management. Compliance bukan sekadar checkbox — ia memaksa organisasi untuk membangun fondasi keamanan yang terstruktur.
Mengapa compliance penting? Karena compliance memaksa standarisasi: tanpa compliance, setiap tim melakukan keamanan dengan cara sendiri. Framework compliance memastikan semua orang bermain di halaman yang sama.
#Framework Compliance
#NIST Cybersecurity Framework (CSF)
| Function | Deskripsi |
|---|---|
| Identify | Asset management, risk assessment |
| Protect | Access control, training, data security |
| Detect | Anomaly detection, monitoring |
| Respond | Response planning, communications |
| Recover | Recovery planning, improvements |
#ISO 27001
Standard internasional untuk Information Security Management System (ISMS).
| Domain | Contoh Control |
|---|---|
| A.5 | Information security policies |
| A.6 | Organization of information security |
| A.8 | Asset management |
| A.9 | Access control |
| A.12 | Operations security |
| A.13 | Communications security |
#SOC 2
Framework yang berfokus pada lima Trust Services Criteria:
| Criteria | Deskripsi |
|---|---|
| Security | Protection dari unauthorized access |
| Availability | System operasional sesuai committed |
| Processing Integrity | System processing lengkap, akurat |
| Confidentiality | Information yang dikonfiden dilindungi |
| Privacy | Personal information dihandle benar |
#Security Metrics & KPIs
#Metrik Operasional SOC
| Metrik | Target | Kegunaan |
|---|---|---|
| MTTD (Mean Time to Detect) | < 1 jam | Kecepatan deteksi |
| MTTR (Mean Time to Respond) | < 4 jam | Kecepatan respons |
| Alert Volume | Trend menurun | Efektivitas tuning |
| False Positive Rate | < 30% | Kualitas deteksi |
| Coverage ATT&CK | > 70% | Visibilitas deteksi |
#Metrik Strategis
| Metrik | Target | Kegunaan |
|---|---|---|
| Patch Coverage | > 95% | Vulnerability management |
| MFA Adoption | 100% | Identity security |
| Security Training Completion | 100% | Human factor |
| Incident Recurrence | < 5% | Effectiveness of lessons learned |
#Reporting ke Management
#Laporan Bulanan SOC
| Section | Isi |
|---|---|
| Executive Summary | 3-5 kalimat poin utama |
| Incident Summary | Jumlah, severity, status |
| Key Metrics | MTTD, MTTR, trend |
| Top Threats | Threat paling relevan bulan ini |
| Recommendations | 3-5 action items prioritas |
Tip
Laporan management harus SINGKAT. Gunakan satu halaman untuk executive summary — leadership tidak punya waktu membaca 20 halaman. Detail teknis bisa dilampirkan sebagai appendix untuk mereka yang butuh.
#Compliance Reporting
| Audience | Fokus |
|---|---|
| CISO | Security posture, risk, budget |
| Board | High-level risk, compliance status |
| Auditors | Control effectiveness, evidence |
| Operations | Action items, gaps |
Note
Compliance reporting bukan aktivitas satu tahun sekali saat audit. Build compliance evidence secara ongoing — document control, collect evidence, maintain audit trail. Ini jauh lebih efisien daripada scrambling saat audit tiba.
#Penutup
Inti yang harus dibawa pulang:
- NIST CSF, ISO 27001, SOC 2 adalah framework compliance utama.
- Metrik operasional (MTTD, MTTR) mengukur efektivitas SOC.
- Laporan management harus singkat dan actionable.
- Compliance reporting harus ongoing, bukan yearly scramble.
Di episode 21 selanjutnya kita akan membahas automation & SOAR — playbook automation, case management, dan orchestration yang mengubah SOC dari manual menjadi efisien.