Tiga vektor yang naik signifikan

SOC Liceo Global menangani 240+ insiden keamanan sepanjang 2024–2025. Tiga vektor menonjol: serangan rantai pasok perangkat lunak (dependency yang dipertaruhkan), phishing yang sangat tertarget (spear-phishing eksekutif), dan ransomware yang menargetkan operasi manufaktur.

Yang sering tidak diharapkan: 73% insiden yang sukses sebenarnya bisa dicegah dengan kontrol dasar yang dipraktikkan secara konsisten — bukan dengan teknologi tercanggih.

Kontrol 1 — Hardening identitas privileged

Akun privileged (admin domain, sysadmin cloud, root) adalah target nomor satu. Privileged identity hardening — MFA wajib, just-in-time access, session recording, dan kebijakan password yang dipaksakan — mencegah 41% dari insiden yang kami tangani.

Implementasi praktis: deploy PAM (Privileged Access Management), pisahkan akun admin dari akun harian, audit akses privileged mingguan, dan rotasi credential setiap 90 hari.

Kontrol 2 — Segmentasi jaringan yang dipraktikkan

Banyak organisasi punya segmentasi pada kertas tetapi tidak pada praktik. Saat insiden, attacker bergerak lateral dengan mudah karena network flat. Segmentasi yang dipraktikkan — micro-segmentation, zero-trust network access, ACL yang ditegakkan — mencegah 22% insiden eskalasi.

Kontrol 3 — Latihan respons insiden secara berkala

Tim yang tidak pernah latihan akan panik saat insiden nyata. Tabletop exercise kuartalan + simulasi teknis tahunan + post-incident review terdokumentasi adalah investasi terbaik untuk kapabilitas respons. Klien kami yang melatih tim secara teratur memiliki MTTR (Mean Time to Respond) 4× lebih cepat.

Apa yang kami sarankan untuk 2026

  • Asesmen maturitas keamanan setiap 12 bulan, dengan fokus pada kontrol dasar — bukan tools.
  • Tabletop exercise minimum dua kali setahun, dengan eksekutif terlibat.
  • Integrasi SOC dengan SIEM dan SOAR untuk respons yang dapat diaudit.
  • Kebijakan zero trust di-roll-out secara bertahap, dimulai dari aset paling sensitif.

Three vectors rising significantly

Liceo Global's SOC handled 240+ security incidents during 2024–2025. Three vectors stand out: software supply chain attacks (compromised dependencies), highly-targeted phishing (executive spear-phishing), and ransomware targeting manufacturing operations.

The often unexpected: 73% of successful incidents could have been prevented with basic controls practiced consistently — not the most advanced technology.

Control 1 — Privileged identity hardening

Privileged accounts (domain admin, cloud sysadmin, root) are target number one. Privileged identity hardening — mandatory MFA, just-in-time access, session recording, enforced password policy — prevented 41% of incidents we handled.

Practical implementation: deploy PAM (Privileged Access Management), separate admin from daily-use accounts, weekly privileged access audits, and 90-day credential rotation.

Control 2 — Practiced network segmentation

Many organizations have segmentation on paper but not in practice. During incidents, attackers move laterally easily because the network is flat. Practiced segmentation — micro-segmentation, zero-trust network access, enforced ACLs — prevented 22% of escalation incidents.

Control 3 — Regularly-exercised incident response

Teams who never practice will panic during real incidents. Quarterly tabletop exercises + annual technical simulations + documented post-incident reviews are the best investment for response capability. Clients who train regularly have 4× faster MTTR.

What we recommend for 2026

  • Security maturity assessment every 12 months, focused on basic controls — not tools.
  • Tabletop exercises minimum twice yearly, with executive participation.
  • SOC integration with SIEM and SOAR for auditable response.
  • Zero trust policy rolled out gradually, starting from most sensitive assets.