Managed SOC: Feder specialist increases cyber resilience

Cybercriminals do not respect business hours

BAUMANN Springs’ IT department, with a team of 18 people, supports approximately 1,400 employees spread across nine locations worldwide. To adequately address the high level of IT protection required, the company implements a range of information security measures. One of these is the deployment of a Security Operations Center (SOC), which professionally protects IT around the clock – including nights and weekends. After all, successful cyberattacks can cause more devastating damage than natural disasters: Floods or fires are limited to specific locations. Cyberattacks, on the other hand, can, in the worst case, paralyze production at all locations simultaneously.

The family business relied on external support for the operation of its SOC early on. Setting up its own SOC would have been virtually impossible for the medium-sized company – especially since BAUMANN Springs competes with numerous large corporations in the war for talent in the eastern part of the canton of Zurich. However, initial experiences with service providers were rather sobering. “The first two providers we worked with failed to meet our expectations. The processes and the way the service was delivered were unsatisfactory,” says Sebastian Müller, Chief Information Security Officer at BAUMANN Springs. “After further evaluation, we became aware of Proact and decided to work with them. We’re still very happy with that.”

Trustful cooperation with clear agreements

The task was handed over to Proact at the beginning of 2024. Shortly thereafter, Sebastian Müller joined as the new CISO. “I was pleasantly surprised by how well the processes with the Proact SOC were already set up. There were clear agreements and well-developed playbooks, i.e., scripts that show how to respond to specific security incidents,” recalls Müller. Initially, for example, contact lists for emergencies were created, workflows were analyzed, and escalation paths were defined. In addition, technical onboarding steps were carried out to optimally adapt the security solutions in use—in this case, the Microsoft Defender Suite and Microsoft Sentinel as a SIEM solution—to the BAUMANN Springs environment.

Day-to-day collaboration is generally handled via a ticket system and Microsoft Teams as a collaboration tool. A small team within BAUMANN Springs acts as an interface to the external SOC. In the event of incidents, for example, it gathers information that is not directly accessible via remote access. Joint evaluations and lessons learned are regularly used to reflect on how well certain processes are working and what can be improved. “What I particularly value about the collaboration is the open and honest communication and the excellent professional advice,” says Müller.

Rapid risk assessment and continuous vulnerability monitoring

Security incidents are investigated quickly, systematically, and routinely. Incident handling runs as reliably as a Swiss watch. Automation and expanded playbooks help effectively protect identities, mailboxes, and devices. Everyone involved knows exactly what tasks they have to perform. The configuration of the security solutions is continuously refined, and the steps to be taken in the event of an incident are trained jointly.

When security vulnerabilities are discovered in widely used software – as recently happened with SharePoint – the team of experts in the SOC immediately analyzes the impact on BAUMANN Springs and forwards the assessment to the IT department. In the case of the SharePoint vulnerability, it quickly became clear that the family business’s infrastructure was not affected. “The quick and well-founded risk assessments of the security situation also help us in our communication with customers and partners,” says Müller. “We maintain ongoing dialogue and view cyber transparency as an important part of a trusting collaboration.” Proactive reporting of security incidents is part of everyday business, especially for services in the medical technology sector.

Continuous development of cyber resilience

The SOC fulfills a key, fundamental function within BAUMANN Springs’ cybersecurity strategy. It primarily helps to make the current security situation transparent, detect incidents early, and respond appropriately. Building on this, the family-owned company relies on an information management system compliant with ISO 27001. Further business continuity management measures are planned for the future to temporarily bridge IT outages.

“IT security is never ‘finished,’ but rather an ongoing task that must take into account the latest developments in a dynamic risk landscape,” says Müller. The fact that this understanding is lived at BAUMANN Springs is also reflected in the support of the topic by the company’s management. Top management meets regularly in the Information Security Steering Board , reviews progress, and plans the next strategic approach. In this way, the company is laying the foundation today for continued market success in the future and for being prepared for the risks of the times.