Threat analysis, penetration testing & co: the versatile job of the cyber security analyst!

The growing number of cyberthreats and cyberattacks is placing ever greater demands on IT security. This now affects all companies, from individual enterprises to global corporations, primarily due to the high degree of digitalisation. As a result, new professions in IT security are constantly emerging. One of these is the cyber security analyst. A profession with a lot of responsibility, good earning opportunities and, above all, a high degree of future security. The cyber security analyst is the digital security chief. He permanently monitors the processes in the network and looks for weak points.

The Cyber Security Analyst - what makes the job tick

The IT Security Analyst is responsible for the digital security of networks. This position either exists directly in the company or he is employed by an IT service provider and carries out his tasks at customer sites. Especially large corporations, KRITIS and government institutions need this professional. For this position, comprehensive and in-depth experience in the field of IT security is required above all.

What tasks does a cyber security analyst perform?

The scope of duties can be compared well with a detective in digital form. Like a detective, the security analyst also uses his or her experience and intuition. The counterpart of the digital detective, the Professor Moriarty of the Internet, is the hacker who threatens the network. As in the novels about Sherlock Holmes, the security analyst tries to uncover the goals as well as the actions of the cybercriminals and to thwart their plans.

The central task of the security analyst is thus to protect the client's data and systems. In doing so, the security analyst works both preventively and actively. Among other things, he implements IT security tools that issue a corresponding warning in the event of conspicuous actions in the network. In addition, he actively monitors the network and the activities in it. With these methods, he detects conspicuous actions in systems that indicate unauthorised actions.

Another important part of the work in this area is analysis. It is about assessing the IT security situation in company networks. For these tasks, the security analyst uses evaluation tools on the one hand, which help him to process log data. On the other hand, he also searches manually. For this reason, he has full access to all areas of the company network. This concerns both the local areas, such as workstation computers or the infrastructure such as routers, as well as external services and systems. Corporate networks have become much more complex in recent years. This is mainly due to outsourced cloud services as well as the home office and mobile work. The increasing number of private end devices, such as smartphones, which are active in the company network, also increase the potential gateways for cyber attacks.

In the context of threat hunting, the security analyst does not only rely on the software that informs him about suspicious activities in the network. He also checks data, logs or accounts and looks for conspicuous actions there. In doing so, he is on the lookout for activities that indicate unauthorised access. In the context of Advanced Persistent Threats, for example, the attackers are often inconspicuously active in the network over a longer period of time and try to gain access to as many areas as possible. This is achieved by raising access authorisations or attempts to access additional accounts. Such actions stand out in log data, for example through accesses from an unknown IP or logins at an untypical time. These are often the first signs of incipient cyber attacks.

If the security analyst encounters such signs or receives a warning message from an IT security tool, he begins with the planned response. Which specific tasks he then has depends on the respective assignment. For example, he informs the responsible persons in IT Security, who then take further measures. In some cases, however, he also becomes active himself and fends off these Advanced Persistent Threats and other cyber attacks. He does this, for example, by deactivating compromised access accounts or disconnecting affected systems from the network and the Internet.

The cyber security analyst usually works in a team. He is part of the IT security team, which also includes consultants, penetration testers and IT forensic experts. In smaller companies, the scope of duties is often broader. In IT security service providers or large corporations, on the other hand, the IT security analyst concentrates entirely on his or her core competencies.

The cyber security analyst has to deal with the entire range of cyber threats. This begins with the defence against viruses and everyday cyber threats. Cyber attacks with ransomware have taken on a high priority. In recent years, more and more companies have become the direct target of Advanced Persistent Threats. With these Advanced Persistent Threats, the attackers proceed very carefully, sophisticatedly and specifically. The background is usually financial and they try to block the entire IT infrastructure if possible. For this very reason, one of the main tasks of the cyber security analyst is to protect one's own company or customer from the dangers of Advanced Persistent Threats.