TR TEST Testing and Evaluation Inc. Cyber Security Director Mustafa Yılmaz said, IT News to Ankara Representative Sedef Özkan and Digital Türkiye His interview published in the magazine:
TRTEST Testing and Evaluation Inc. Cyber Security Director Mustafa Yılmaz said, "Cyber Security Cluster is a strong ecosystem where companies that provide services and produce products in the field of cyber security in Turkey come together. As TRTEST, we are also a part of this strong ecosystem. The power of this ecosystem should be evaluated as the power of our country in cyber security. In other words, companies serving in this field should both benefit from this power and contribute to this power, contributing to the further progress of our country in this field."
"TRTEST Test and Evaluation Inc. is a company established in partnership with the Presidency of Defense Industries (SSB), Turkish Standards Institute (TSE), Turkish Scientific and Technological Research Council (TÜBİTAK), Turkish Armed Forces Foundation (TSKGV), STM Defense Technologies Engineering and Trade Inc. to carry out strategic activities such as creating a domestic test infrastructure inventory, ensuring the domestic feasibility of tests that cannot be carried out in Turkey, and undertaking the operation of public domain test centers." Yılmaz conveyed the vision of the company as follows: "TRTEST acts with the vision of meeting the testing needs of the domestic industry, especially the defense industry, and being an independent, reliable testing authority in advanced technology / value-added product tests and a company that tests with domestically produced devices. TRTEST is not a rival or alternative to any existing structure, a solution partner in the effective use of existing infrastructures, a coordinator in the planning of new investments, a stakeholder in the effective use of public infrastructures, an active in the certification of domestic products, an anonymous supporter in human resources development, a technology-oriented company." is the company.” Yılmaz continued his speech by stating, "We provide services in a very broad perspective, such as ballistic tests, EMI/EMC tests, environmental tests, CBRN tests, cyber security and software tests, land vehicle tests, training and product certification, which we have not mentioned here yet." "We carry out projects and operate actively in many areas such as (CIP), Aksaray Firing Range and Test Center Infrastructure Establishment, KALECİK UAV Test Field Installation and Operation, Ballistic Test Center (BTM) Project, EMI/EMC Laboratory Investment Project, Training Services, Product Certification."
'Cyber Security Products Testing and Certification Project' was launched with the Cyber Security Cluster
When we look at the cyber security products used by public institutions and organizations and the private sector in our country, Yılmaz pointed out that the majority of them are products of foreign origin and stated that the products developed by our domestic and national manufacturers are not used at the desired rate. Yılmaz said, "In the discussions held with public institutions and organizations and the private sector, the main reason for this is a lack of trust in the products developed by our domestic and national manufacturers. In particular, it is complained that the products do not have a certain quality and maturity." In order to make their reliability and maturity visible, the 'Cyber Security Products Testing and Certification Project' was initiated by the Turkish Cyber Security Cluster, which was established under the leadership of the Presidency of Defense Industries. The project is carried out by TRTEST. This project includes testing and certification activities within the scope of the products developed by the companies that are members of the Turkish Cyber Security Cluster. "Our companies, which have passed the testing and certification mechanism and are entitled to receive the 'TRTEST Product Conformity Certificate', will instill confidence in the parties who will be the users of these products with their certificates. Therefore, we are working intensively with the Cyber Security Cluster through the 'Cyber Security Products Testing and Certification Project' that I have mentioned."
The frequency and impact of cyber attacks are increasing due to poor cyber habits
Mustafa Yılmaz continued to explain his work with the Cyber Security Cluster as follows: "Apart from this, we also carry out conformity assessment studies not only from the product perspective, but also from the institutional and systemic perspective. In this context, we have carried out the 'Cyber Hygiene Certification Program'. The necessity of determining the general measures that companies in the supply chain and doing business in the defense sector, which is one of the most critical infrastructures for our country, and in the supply chain, should be taken within the scope of information and communication security, and the necessity of reducing and eliminating information security risks remains critical day by day. Ensuring the security of information / data." Both the frequency and impact of cyber attacks are increasing day by day due to weak cyber habits. The 'Cyber Hygiene Project', which is a basic principle in information security that emphasizes the importance of taking regular and effective security measures to address this situation, was initiated by TRTEST under the leadership of our Presidency of Defense Industry. Within the scope of the 'Cyber Hygiene Certification Program', national and international studies are carried out to examine the surfaces where many companies, from large companies to small local businesses, are most attacked and take precautions regarding these attack surfaces. "Cyber Hygiene Emergency Measures Criteria Set v1.0" was created for cyber hygiene needs. The levels are "Awareness, Basic, Medium, Advanced". In this context, there are institutions that are entitled to receive a "Cyber Hygiene Certificate" and their inspections are ongoing.
Türkiye National Cyber Demonstration Center (TUSGM) Project emerged in line with the need
Underlining that, in addition to the Cyber Security Products Testing and Certification Project and the Cyber Hygiene Certification Program, they also carry out studies within the scope of the Turkish Cyber Security Cluster and the Turkey National Demonstration Center Project, Yılmaz said, "The 'Turkish National Cyber Demonstration Center (TUSGM) Project' emerged in line with the need for an environment where proof of concept (PoC) studies could be carried out in order for companies that are members of the Turkish Cyber Security Cluster to demonstrate the capabilities of the domestic products they have developed to their customers." Yılmaz explained, "This project, which was initiated to mediate the transportation of domestic and national products with cyber security solutions to national and international markets, will allow public institutions and companies operating in the private sector to test the end-to-end integrated and stable interoperability of more than one domestic and national product at the same time." It is aimed to contribute to the development of the local and national product ecosystem in terms of the interaction and integration of security solutions. As a result, we are actively working together with the Turkish Cyber Security Cluster on the projects I briefly mentioned above. This cluster is a strong ecosystem where companies that provide services and produce products in the field of cyber security in Turkey come together. As TRTEST, we are also a part of this strong ecosystem. Perhaps we should look at the issue from this perspective: The power of this ecosystem is the power of our country in cyber security. "We must benefit from this power and contribute to this power, contributing to the further progress of our country in this field."
TRTEST Product Conformity Certificate was given to 21 products whose tests were completed and passed successfully.
Mustafa Yılmaz pointed out that they carry out the testing and certification processes in 3 main processes and shared the following details: "These are the 'Criteria Determination process, the Contract with the Subcontractor - Methodology Study and Consensus Meetings process, and the Test and Certification process'. We carry out the 'Criteria Determination' process by holding meetings under the leadership of the Presidency of Defense Industries with the participation of TRTEST and the relevant product group manufacturers, laboratories and academia from the Turkish Cyber Security Cluster. As a result of the meetings held, each Specific to the product group, we are trying to establish the criteria that that product group should meet. In this context, we have been organizing active workshops and meetings since 2019. With the meetings held, the criteria are set in the product groups 'Firewall, SIEM, DLP, Vulnerability Management, Threat Intelligence, EPP, EDR, Governance Risk Compliance, Secure Messaging, Identity and Access Management, Video Conferencing, IoT, NAC, Forensics, Sd-Wan, Data Diode'. Work on determining criteria for new product groups under the headings of 'Threat Simulation, SOAR, WAF' has begun. In the 'Contract, Methodology Study and Consensus Meetings with the Subcontractor' process, offers are evaluated together with the SSB and contract negotiations are held with the determined subcontractor. After the contract, a methodology study is carried out with the subcontractor on how the criteria will be tested and the expected requirements for the test. "Technical meetings are held with the parties and consensus meeting processes are carried out." "In our last process, 'Testing and Certification', the tests of the applicant manufacturer are started with the participation of TRTEST, the relevant subcontractor and the relevant manufacturer, and the tests are carried out under the control, supervision and observation of TRTEST," said Yılmaz, adding: "In summary, the products of the manufacturers in the mentioned product groups are evaluated by TRTEST and the subcontractors it authorized within the framework of the established criteria and test methodologies established within the scope of the criteria, and tests are carried out specific to the product group. TRTEST tests are carried out for the products that have passed the tests successfully." 'TRTEST Product Conformity Certificate is given' by 'TRTEST Product Conformity Certificate' was given to 21 products that were tested successfully. There are currently ongoing product tests. Additionally, new product tests are constantly being started.
Testing and certification processes serve as a tool to prove the competence of the product.
"When we look at conformity assessment activities under the umbrella name of testing and certification, the most important benefit of these activities is that they instill confidence in the users of this product," said Yılmaz, adding: "Because the products that have gone through the testing and certification processes show that they pass the criteria created by common sense and meet these requirements. The difference between a value-added product / service and a product of relatively inadequate quality is revealed on this occasion. This also provides convenience in terms of marketing to the manufacturers who have proven this by successfully completing the testing and certification process." Testing and certification processes also serve as a tool to prove the competence of their products for companies that are confident in their products and have various difficulties because they cannot convince the other party about the competence of their products.” Yılmaz underlined that TRTEST continues to discuss potential business collaborations with domestic and foreign institutions and companies and said, "As a result of the negotiations with the State Materials Office in our country, TRTEST Approved manufacturers are included in the DMO Teknokatalog with the TRTEST logo. In addition, the number of institutions looking for TRTEST approved products in their specifications is increasing day by day. Many meetings are also held abroad. Especially on the IoT point, close discussions are being held with the IoT working group established under the World Economic Forum. "Round table meetings are attended by representatives of the countries and studies are continuing on the mutual recognition of the certificates. In addition, it is important in terms of added value that our country has gained criteria / standards in the field of cyber security with the criteria we are trying to create in the testing and certification processes, that the criteria / standards are known by a wider audience, and that the criteria are fundamental to national security as they are related to cyber security."
The efforts of our producers should be rewarded
Yılmaz commented, "We consider our activities as important activities aimed at the development of our country's cyber security ecosystem and proving its quality," and concluded his speech by emphasizing the following points: "In this sense, it is important for our manufacturers, who trust their products and systems and believe that they have a certain maturity, to undergo testing and certification processes and, in a way, register the quality of their products and systems. Of course, manufacturers spend a certain effort, time and cost for these processes. In this context, these efforts should be rewarded within the framework of the principle that ingenuity is subject to compliment, in other words, this “The number of organizations that request certifications and give priority to certified products should increase further.”
Gallery
