Implementation of a Security Information and Event Management System with Alert Automation to Strengthen Cybersecurity

Valladares S.; Ticona W. · Lecture Notes in Networks and Systems (2025) · DOI: 10.1007/978-3-032-03406-9_7

Resumen

IT security is a critical issue due to the increasing number of cyber threats, especially in critical sectors such as healthcare. Hospitals handle sensitive information that targets cybercriminals, and serious incidents have been reported worldwide and in Latin America. To improve this situation, it is proposed to implement a security event management system (SIEM) with automated alerts to strengthen cybersecurity and optimize the response to healthcare threats. The PPDIOO methodology was applied and consists of six phases: prepare, plan, design, implement, operate, and optimize. The methodology is adaptable to different projects and encourages continuous improvement, making it ideal for IT project management. The results demonstrate significant improvement in the detection and response to security incidents. The improvement in system operational efficiency ranged from 50% to 80%. In addition, the reduction from 4 to 2 h demonstrates that the system provides faster and more efficient response. In terms of security, it reflects a preventive improvement in network security, which decreases the risk from 25.53% to 0.05. Finally, it is concluded that SIEM with alert automation is an effective tool to strengthen cybersecurity in the healthcare sector, achieving early detection of threats with an accuracy rate of 90% and a reduction in response time of 45%. The methodology applied in the implementation of the proposed system ensured efficient integration, resulting in a 30% reduction in initial incidents during the evaluation period. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2025.

Instituciones: Universidad Tecnológica del Perú