Tag: security

Security Operation Center (SOC), a central function within an organisation, uses people, processes and technology to monitor and improve security posture of an organization while responding to cybersecurity incidents.

The SOC is the central command point or hub of telemetry, collecting data from all parts of an organization’s IT infrastructure. This includes its devices, networks, appliances and information stores. Due to the proliferation of advanced threats, it is important to collect context from multiple sources. The SOC is basically the point of correlation for all events that are logged within an organization. The SOC must determine how each event will be handled and acted on.

Security personnel and organizational structure

A security operation team (or, more often, a security center) is responsible for monitoring, investigating, responding to, and investigating cyberthreats 24 hours a day. Security operations teams are responsible for protecting intellectual property, business systems, brand integrity, and personnel data. Security operations teams are the core of an organization’s overall cybersecurity strategy. They act as the point of convergence in coordinated efforts to assess, monitor, and defend against cyberattacks.

SOCs are typically built around a hub and spoke architecture. This allows for a wide range of systems to be integrated, including vulnerability assessment solutions (GRC), application and database scanners (IPS), entity and user behavior analytics ( UEBA), endpoint discovery and remediation ( ), threat intelligence platforms (TIP).

SOC managers usually lead the group. They may include threat hunters, incident responders, SOC analysts (levels 1, 2, and 3), and incident response manager(s). The SOC reports directly to the CEO or the CIO.

SOC processes

Stage 1: Event Classification and Triage

What is the importance of this?

Log data analysis is a valuable tool that allows you to correlate and analyze log data. Key indicators of compromise include user activity, system events, firewall acceptance/denies, and firewall accept/denies. You should also be alerted to specific sequences or combinations of these events within specific patterns. This stage is crucial for success. You need to be able to quickly classify events so you can prioritize and escalate important events that require further investigation.

What do SOC Analysts do at this Stage?

The latest events with the greatest severity or criticality are reviewed by Tier 1 SOC analysts. After confirming that these events warrant further investigation, they will escalate the matter to a Tier2 Security Analyst. Please note that smaller teams may have the same analyst who investigates issues as they escalate into a more detailed investigation. Documenting all activity is key to success at this stage (e.g. notation, trouble ticket, etc).

It is crucial to identify attacker activity early in an attack before sensitive data or systems are compromised. It is more likely that attackers will succeed in their attacks as they move up the kill chain stages. You can identify which events need your attention by looking at infrastructure activity and environmental behavior from the attacker’s point of view.

Stage 2: Prioritization and Analysis

What is the importance of this?

Prioritization is key to success in all endeavors, but it is even more important in cyber security. The stakes are high, and the rate of attacks is increasing at an alarming pace that shows no signs of slowing down. The resources available to protect assets from this attack are very limited. You need to focus on the events that have the greatest impact on business operations. This requires you to know which assets are most important. The most important responsibility of the SOC team is to ensure business continuity.

What do SOC Analysts do at this Stage?

Any activity that suggests an adversary has infiltrated the environment should be reviewed and addressed. This could include the installation of a rootkit/RAT, backdoor or other means to exploit an existing vulnerability in network communications between an external host and a known bad address associated with cyber adversaries’ C2 infrastructure.

Stage 3: Recovery & Remediation

What is the importance of this?

You can prevent similar attacks from occurring by responding quickly to any incident you detect. It is important to note that there are many decisions to be made when investigating an incident. This includes whether your organization is more concerned with recovering from the damage than investigating it as a criminal offense. Your management team should be involved in your investigation. Communicate clearly and frequently with your management team. Document everything.

What do SOC Analysts do at this Stage?

Although each attack is different in terms of the correct remediation steps that should be taken on affected systems, it will usually involve one or more the following steps:

• Re-image your systems and restore backups
• Update or patch systems (e.g. Update apps and OS versions
• System access can be re-configured (e.g. Account removals, password resets
• Re-configure network access (e.g. Re-configure network access (e.g.
• Monitor servers and assets for vulnerabilities (e.g. Enable HIDS
• Run vulnerability scans to validate patching procedures and security controls

Some SOC teams also delegate remediation and recovery tasks to other IT groups. In such cases, the SOC analyst would open a ticket or change control request and then delegate it to system and desktop operations.

Stage 4: Audit & Assessment

What is the importance of this?

It is always best to fix vulnerabilities as soon as possible to prevent attackers from gaining access to your environment. It is best to conduct periodic vulnerability assessments, and then review the report findings. These assessments will not identify procedural vulnerabilities, but technical ones. Make sure that your team also addresses gaps in your SOC processes that could put you at risk.

What do SOC Analysts Do at this Stage?

SOC team members are most commonly responsible for running network vulnerability scans or generating compliance reports. SOC team members can also review their SOC processes and share them with external audit teams (internal or extern) in order to ensure policy compliance and to determine how to improve SOC group performance.

The SOC performs 10 key functions

1. Take stock of all available resources

The SOC is responsible to two types of assets: the various processes, applications, and devices they are charged with protecting, and the defensive tools that they have at their disposal to ensure that protection.

• What the SOC Protects
  Devices and data that the SOC cannot see can’t be protected. There are likely to be gaps in the network security posture without visibility and control, from the device to the cloud. The SOC’s goal in gaining a comprehensive view of the threat landscape of the company includes all types of endpoints, servers, and software, as well as third-party services and traffic between them.
• The SOC Protects
  A complete knowledge of all cybersecurity tools and workflows used within the SOC is essential for the SOC. This improves agility and allows the SOC run at its peak efficiency

2. Preparation and preventative maintenance

Even the most agile and well-equipped response systems are not able to prevent problems from happening in the first place. The SOC has two major categories of preventative measures that can be used to keep attackers away.

• Preparation
  Keep your team informed about the latest security trends, cybercrime developments and new threats. This research can be used to help create a security roadmap for the company that will guide its cybersecurity efforts moving forward. It will also include a disaster recovery plan that will offer guidance in the worst-case scenario.
• Preventative Maintenance
  This step covers all actions that are taken to make successful attacks more difficult. These include regularly updating and maintaining existing systems, updating firewall policies, patching vulnerabilities, and whitelisting, blocking, and securing apps.

3. Continuous Proactive Monitoring

The SOC uses tools to scan the network 24 hours a day to identify suspicious activity or anomalies. The SOC can monitor the network 24/7 to alert them of any emerging threats. This gives them the best chance of preventing or minimising harm. A SIEM, an EDR or an EDR are all possible monitoring tools. Better still, an SOAR, or an XDR can be used to use behavioral analysis to teach systems the difference between normal day-to-day operations or actual threat behavior. This reduces the amount of human triage and analysis.

4. Alert Management and Ranking

The SOC is responsible for reviewing all alerts issued by monitoring tools, discarding false positives and determining how serious any threats might be. This allows them to quickly triage any emerging threats and deal with the most pressing issues first.

5. Threat Response

These are the actions that most people associate with the SOC. The SOC is the first responder when an incident is confirmed. They perform actions such as shutting down or isolating any endpoints, stopping harmful processes from executing, deleting files and many other tasks. It is important to provide a quick response that has minimal impact on business continuity.

6. Remediation and Recovery

The SOC will restore data and systems in the wake of an incident. The SOC may need to wipe and restart endpoints, reconfigure systems, or in the case ransomware attacks deploy viable backups to avoid the ransomware. This will restore the network to its previous state if it is successful.

7. Log Management

The SOC is responsible to collect, maintain, and review the logs of all communications and network activity for the entire organization. These data can help establish a baseline of “normal” network activity and reveal threats. They can also be used to remediate and forensically investigate the incident. Many SOCs use SIEMs to combine and correlate data feeds from applications and firewalls.

8. Root Cause Investigation

The SOC is responsible for investigating the incident’s aftermath to determine what happened, when and how it occurred. The SOC uses log data, as well as other information, to track down the source of the problem. This will allow them to prevent similar incidents from happening in the future.

9. Security Improvement and Refinement

Cybercriminals constantly improve their tactics and tools. The SOC must implement continuous improvements to keep them ahead. This step will bring to life the Security Road Map’s plans, but it can also involve hands-on practice such as red-teaming or purple-teaming.

10. Compliance Management

While many of the SOC’s processes follow established best practices, some are subject to compliance requirements. Regular audits of the SOC’s systems are required to ensure compliance with regulations. These regulations may be issued by the organization, their industry or by governing bodies. These regulations include HIPAA, GDPR, and PCI DSS. These regulations can help protect sensitive data the company has been given, but it can also protect the organization from reputational damage or legal challenges that may result from a breach.

Optimizing security operations models

The SOC is primarily responsible for incident management, but the chief information security officer (CISO), is responsible to ensure compliance and risk management. An adaptive security architecture is required to bridge the operational and data silos between these functions. It allows organizations to implement optimized security operations. This approach improves efficiency by integrating, automating, and orchestrating. It also reduces labor hours and improves information security management.

A security framework is essential to optimize security operations. It makes it simple to integrate security solutions with threat intelligence into daily processes. SOC tools such as centralized and actionable dashboards integrate threat data into security monitoring dashboards. Reports are used to keep management and operations informed about any changes. SOC teams can improve their overall risk management by linking threat management to other systems that manage risk and compliance. These configurations allow for continuous visibility across domains and systems. They can also use actionable intelligence to improve accuracy and consistency in security operations. Centralized functions make it easier to share data, audit and report across the board.

A thorough assessment is essential in order to operationalize threat management. An organization must evaluate its processes and policies, in addition to its defenses. What are the strengths of your organization? What are the weaknesses? What is your risk profile? What data are you collecting and how much data are you using?

Every organization is unique, but there are certain core capabilities that every company should have and best security operations practices. A plan is the first step in a reasonable threat management process. It includes discovery (including baseline calculations to promote anomaly detection and normalization and correlation), triage (based upon risk and asset value), analysis, contextualization, scoping, and iterative investigation. Interruption response programs are fed from the prioritized and characterized incidents managed by threat management processes. It is essential to have a well-crafted response plan in place to contain a threat and minimize the damage caused by a data breach.

Although there are many data sources available for effective visibility and threat management, it can be difficult to find the most useful and current information. Event data from countermeasures and IT assets, indicators or compromise (IoCs), produced internally (via malware analyses) and externally via threat intelligence feeds, and system data collected by sensors (e.g. host, network, and database). These are the most valuable data. ).

These data sources are more than just an input for threat management. They provide context and make the data valuable and actionable, allowing for more accurate, precise and quick assessment during the interactive and iterative threat management process. Organization maturity is measured by the ability to access and make effective use of the relevant data to support plans or procedures. A mature scenario is one that has a workflow that allows for direct action within the operational consoles or across products. This flows integrates IT operations with security teams and tools to provide incident response for critical events.

These assessments will help you prioritize areas where more investment or less friction is required to achieve your threat management implementation goals. Penetration tests and consultants can help to benchmark strategy, organizational maturity, and security response to attacks in order to determine the current level of an organization’s ability detect and contain malicious events. This vetted review, which compares against other enterprises, can help to justify and explain the need for cybersecurity operations resources to be redirected or invested in.

References

• https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-soc/
• https://www.trellix.com/en-us/security-awareness/operations/what-is-soc.html
• https://www.microfocus.com/en-us/what-is/security-operations-center
• https://digitalguardian.com/blog/what-security-operations-center-soc