Background
ACME energy has diversified and are looking at Wind as an alternate power source. There is an ambitious
multi-billion dollar investment plan to put an offshore wind farm with turbines generating energy to help offset
the energy demand.
To support this business initiative, the Group CIO and CISO are working with regional CIOs and CISOs in the
respective countries to identify the future IT and Security strategy to support this initiative. This is a multi-year
investment program, and the decision has been taken to use the public cloud to build the future IT
environment for this initiative. This is also part of a wider cloud migration plan for ACME Energy.
The result is a new IT strategy and a corresponding Cybersecurity strategy with several security programs that
need to be implemented over a three year period. ACME uses the NIST cybersecurity framework, CIS 18 for
operational controls and the CSA CCM 4.0 for cloud security controls.
ACME has decided to partner with ZKC Consulting to deliver the cybersecurity strategy and work with regional
Cybersecurity teams to implement the changes. The company has taken a cloud first approach to implement
the two new IT strategic programs and three strategic security programs listed below.
 Design and implementation of new wind farm using cloud technology and remote software updates.
 Creation of a new data lake that will be used to collect data from the wind turbines and other OT
devices, which will be used for several purposes including system monitoring and advanced data
analytics capabilities.
The strategic security programs are as follows:
 Provision of secure data connectivity from the wind turbines to the Cloud (the could provider has not
yet been confirmed).
 Creation of a new OT Security Operations centre that will monitor the security of the OT devices used
in the windfarm.
 Creation of a new Threat Intelligence program to protect the new wind farm infrastructure against
cyber threats.
Your Role
In your role as an external security consultant, you are required to provide a report advising on the
implementation of one of the strategic security programmes: Creation of a new OT Security Operations
centre that will monitor the security of the OT devices used in the windfarm.
The CIO of ACME has been working with the CISO team to identify the capabilities required to build a Security
Operations Center (SOC) that will monitor the security of the OT devices. The agreement is to build a SOAR
platform that will provide the orchestration, automation and response. This is in addition to the vulnerability
management and penetration testing requirements. Both teams have agreed that all products need to be
cloud native and should include the use of a SIEM. The CIO wants to use Azure Sentinel as the SIEM but the
CISO want to use Google Chronicle. This SIEM will also be used to monitor the security of the data lake. The
CISO wants to use Qualys as the vulnerability management tool as it is currently being used in ACME.
You are expected to provide the following high level outputs for the first phase of the project:
 Outline the requirements for SOAR in the context of ACME’s operations.
 Propose a specific SOAR solution based on your requirements.
 Explain the security controls that need to be implemented for the proposed SOAR solution.
 Evaluate the Azure Sentinel and Google Chronicle SIEM solutions and provide your recommendation.
Please explain the criteria you will be using for your analysis (you do not need to consider criteria
which are not directly impacting the security operations, e.g. costs).
 Explain the operational procedures the SOC team needs to create to deal with security threats.
 Please explain how you will integrate different data sources into the SIEM to create a single pane of
glass view that will provide security analysts the relevant information.
 Investigate if the Qualys vulnerability management tool is the best tool for ACME and if you feel this is
not the right tool, please provide a gap analysis and recommend the tool that should be used.
 Explain the pentesting approach and define the scope of the pentesting program.