The use of advanced cybersecurity services by Lietuvos Paštas was motivated not only by the fact that the company is classified as Critical Infrastructure according to the national Cybersecurity Classification, which obliges it to apply the security requirements stipulated in the legal acts. In addition, Lietuvos Paštas handles large amounts of sensitive information in its operations, which imposes additional obligations and responsibilities on the company.

“Better data protection and operational assurance have become key objectives in the planning of cyber incident monitoring. In addition, we already had the main tool of the Security Operations Centre (SOC) – SIEM – and wanted to make the most of its potential,” says Gintaras Bertašius, information security expert at Lietuvos Paštas.

However, according to Bertašius, there was no thought of developing a Security Operations Centre, as a centre of its own would be isolated from the more general circulation of information. Organisations are usually reluctant to share information about threats or actual attacks.

“Our decision to look for cyber incident monitoring services was also influenced by this circumstance. The need for security operations in an organisation may be high, but obtaining the competencies and, more importantly, the expertise and other necessary information would become a challenge. Experience, however, tends to be concentrated with external suppliers who have more than one client. Due to the larger number of clients, there is a synergy of information, which allows for faster detection of attack indications in one organisation and proactive protection and warning of threats in other organisations,” says the representative of Lietuvos Paštas, one of the most important reasons to choose external suppliers.

The IT company Blue Bridge has won a public tender to provide cyber incident monitoring services to Lietuvos Paštas. According to Povilas Kaminskas, Head of the Security Operations Centre of the company, the work started with an analysis of SIEM rules and a list of monitored objects. This list included firewalls, web-based applications, email security solutions, etc. in order of priority.

“Event information from the monitored objects goes to the SIEM, where our team analyses the events according to the level of criticality and classifies them as either minor or major. We send the structured information about cyber threats to the Lietuvos Paštas team, which takes care of the threats and no longer spends time screening events. Lietuvos Paštas team can also consult on the best way to respond to the incident and prevent it,” says P. Kaminskas, adding that, if required, the Blue Bridge Security Operations Centre team can also provide an incident management service, which not only includes the detection of threats, but also proactive work with the client’s team to prevent these threats.

Speaking about the initial stages of the project, the information security expert of Lietuvos Pasts stresses the importance of the client’s involvement, “The success of projects related to cyber security depends to a large extent on the client – on the priorities that the team will set, the sources of the information that the supplier will be working with, etc. So in that sense, the foundation for success, even after the purchase of security operations services, is laid by the customer.”