Turkish Airlines: Threat-centric Validation for a Vast Security Estate

Enhanced Visibility for and Empowered
For Engin Karagülmez, Information Security Manager, the benefits of threat-centric control validation rest on visibility. This applies across the board – from visibility of operational practices, to foresight of new threats, as well as bottom-up visibility and reporting to security leadership. “Our expectation was to provide visibility into how effectively we use those products that support security management and security operations.” Turkish Airlines delegated management of Picus in the hands of Emre Kaçmaz from the SOC team. This not only gave them oversight of operational best practices and how they support a strong baseline, but it also conveyed the agility needed to anticipate incoming threats. “Why is our SOC managing Picus? I wanted Picus to be managed by the team with the most streamlined risk management processes. The attack techniques and tactics of APT groups overlap with a SOC’s capabilities.” Emre Kaçmaz also stresses out the importance of aligning prevention, mitigation and detection efforts. Turkish Airlines’ security personnel make intensive use of the vendor-specific mitigation advice provided by The Picus Platform. “As you know, prevention is the first line of defense and if mitigation cannot be applied or delayed, we implement rules for detection.” He also says that Picus Security's recently launched Detection Analytics functionality definitely makes sense in building more agile detection capabilities.

An Instrument of Proactive Security
Engin Karagülmez concedes that Turkish Airlines found the best use of Picus within its SOC. For Turkish Airlines, threat awareness and continuous security validation lay the foundations for proactive cyber vigilance. “Picus’s results provide real evidence. If there is a serious threat here, we consider it as a result of any penetration test or red team activity. We promptly ask to open a case, make an assignment, fix a due date and take action, just following our normal procedures.” For the leading flight operator’s security team this means keeping an ear to the ground and proactively act on the result of their expanded testing estate, which does encompass expert Pen Testing and Red Teaming on the one hand, but it is independently supported by Picus on the other. In order for testing to walk on both legs, the team at Turkish Airlines amplified focus by allocating dedicated resources to each approach.

Improving Cross-team Collaboration
In the case of Turkish Airlines, The Picus Platform has also increased and facilitated communication within the cyber defense organization in order to support new initiatives, budget allocation and to foster the relationship between SOC and SecOps. For executives, Picus has been an instrument of evidence-based management. Through Picus, the company’s top management has been able to track the output of their security investments and get feedback on further initiatives necessary to manage cyber risk. For operations on the other hand, by using Picus, SOC professionals are more aware of infrastructure management and conversely, SecOps become more involved in cyber defense activities. Besides operations, Picus helped connect multiple departments, and craft and validate policies. “Just as an example, we can tell the Governance team that encrypted attachments can go out, and ask them to write a policy about this,” says Emre Kaçmaz.