Skill Set Needed to work successfully in a SOC

•

3 gefällt mir•3,434 views

Fuad Khan

WHAT IS A SECURITY OPERATIONS CENTER?
• An organization for computer network defense. Used to defend a computer
network against unauthorized activity.
• There are many other names and organization for this role such as
• Computer Security Incident Response Team (CSIRT)
• Computer Incident Response Team (CIRT)
• Computer Incident Response Center (CIRC)
• Computer Security Incident Response Center (CSIRC)
• Security Operations Center (SOC)
• Cybersecurity Operations Center (CSOC)

EXPOSURE TO IT SECURITY STANDARDS
• Extensive IT Security and incident response handling experience
• NIST SP 800-61 Computer Security Incident Handling Guide
• SOC SOP and procedures
• Agency SOC procedures
“Real Knowledge is knowing the extent of one’s ignorance”

UNDERSTAND THE LIFESTYLE AND DEMANDS OF SOC
• Daily operational needs
• Always be ready for the next incident
• Live in the present, past is not important
• Not a project based lifestyle, live in the present
• Are you ready and able to do shift work
• Operations oriented
• Waiting for the bad guys to attack
• Fast changing environment
• Constant learning
• Difficult to live with for most people as it difficult and high energy demands.

WHAT DOES A TIER 1 SOC ANALYST DO?
• Observe SIEM logs and other analytic senor data points.
• Curious about everything
• First line of defense in the SOC
• Put in the trouble tickets
• Keep awake and have good customer related skills
• Sometimes have to do above and beyond in times of need
• Everyone starts in a SOC at tier 1
• Most SOC managers want you to start at tier 1 to learn the ropes and SOC
processes
• You will learn security and get a wide range of security experience

WHAT DOES A TIER 2 SOC ANALYST DO?
• More responsibility
• More research
• More visible
• Developing a solution set for tier 1 analysts
• Managing the tier 1 analysts
• More analysis and checking for patterns of malware
• Work on analyzing the intrusion detection patterns
• Automate repetitive tasks via scripting or automation language
• Create shortcuts
• Need to have decent programming skills, security knowledge and curious

WHAT DOES A TIER 3 SOC ANALYST DO?
• Master of a particular security area
• In-depth knowledge and experience in multiple areas of security
• Usually have advanced security certifications like OSPF and SANS training
• Work as hunters, hunting for the malware path and removal
• Forensic analysis of memory, hard drive and session traffic
• Most elite role in the SOC
• Highly sought after security experts

WHAT DOES EVERYONE NEED TO DO
• Teamwork
• Teamwork
• Teamwork

NEED MORE INFORMATION
Read Carson Zimmerman excellent book on Cybersecurity Operations Center

Empfohlen

Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsShah Sheikh

Owasp Proactive Controls for Web developerSameer Paradia

DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh

SocMukesh Chaudhari

What We’ve Learned Building a Cyber Security Operation Center: du Case StudyPriyanka Aash

Bulding Soc In Changing Threat LandscapefinalMahmoud Yassin

Soc analyst course contentShivamSharma909

Exercise Your SOC: How to run an effective SOC response simulation (BSidesCha...Brian Andrzejewski

Empfohlen

Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsShah Sheikh

Owasp Proactive Controls for Web developerSameer Paradia

DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh

SocMukesh Chaudhari

What We’ve Learned Building a Cyber Security Operation Center: du Case StudyPriyanka Aash

Bulding Soc In Changing Threat LandscapefinalMahmoud Yassin

Soc analyst course contentShivamSharma909

Exercise Your SOC: How to run an effective SOC response simulation (BSidesCha...Brian Andrzejewski

Rothke rsa 2012 building a security operations center (soc)Ben Rothke

Manoj purandare - Stratergy towards an Effective Security Operations Centre -...Manoj Purandare ☁

An introduction to SOC (Security Operation Center)Ahmad Haghighi

SOC Architecture Workshop - Part 1Priyanka Aash

Strategy considerations for building a security operations centerCMR WORLD TECH

IT Cyber Security OperationsNapier University

Security operation center (SOC)Ahmed Ayman

Building Security Operation CenterS.E. CTS CERT-GOV-MD

Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH

Accelerating OT - A Case StudyDigital Bond

SCADA Security WebinarAVEVA

Rothke secure360 building a security operations center (soc)Ben Rothke

Security operations center 5 security controlsAlienVault

SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...AlienVault

5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)Vijilan IT Security solutions

Security Operations Center (SOC) Essentials for the SMEAlienVault

From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash

Next-Gen security operation centerMuhammad Sahputra

Building a SOC - hackmiami 2018Jose Hernandez

Effective Security Operation Center - present by Reza AdinehReZa AdineH

Emergencies and on callChris Beyer

2015-ShowNet-報告資料Interop Tokyo ShowNet NOC Team

Weitere ähnliche Inhalte

Was ist angesagt?

Rothke rsa 2012 building a security operations center (soc)Ben Rothke

Manoj purandare - Stratergy towards an Effective Security Operations Centre -...Manoj Purandare ☁

An introduction to SOC (Security Operation Center)Ahmad Haghighi

SOC Architecture Workshop - Part 1Priyanka Aash

Strategy considerations for building a security operations centerCMR WORLD TECH

IT Cyber Security OperationsNapier University

Security operation center (SOC)Ahmed Ayman

Building Security Operation CenterS.E. CTS CERT-GOV-MD

Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH

Accelerating OT - A Case StudyDigital Bond

SCADA Security WebinarAVEVA

Rothke secure360 building a security operations center (soc)Ben Rothke

Security operations center 5 security controlsAlienVault

SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...AlienVault

5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)Vijilan IT Security solutions

Security Operations Center (SOC) Essentials for the SMEAlienVault

From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash

Next-Gen security operation centerMuhammad Sahputra

Building a SOC - hackmiami 2018Jose Hernandez

Effective Security Operation Center - present by Reza AdinehReZa AdineH

Was ist angesagt? (20)

Rothke rsa 2012 building a security operations center (soc)

Manoj purandare - Stratergy towards an Effective Security Operations Centre -...

An introduction to SOC (Security Operation Center)

SOC Architecture Workshop - Part 1

Strategy considerations for building a security operations center

IT Cyber Security Operations

Security operation center (SOC)

Building Security Operation Center

Security operations center-SOC Presentation-مرکز عملیات امنیت

Accelerating OT - A Case Study

SCADA Security Webinar

Rothke secure360 building a security operations center (soc)

Security operations center 5 security controls

SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...

5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)

Security Operations Center (SOC) Essentials for the SME

From SIEM to SOC: Crossing the Cybersecurity Chasm

Next-Gen security operation center

Building a SOC - hackmiami 2018

Effective Security Operation Center - present by Reza Adineh

Andere mochten auch

Emergencies and on callChris Beyer

2015-ShowNet-報告資料Interop Tokyo ShowNet NOC Team

Advancing From Fault Management To Fault Resolution FrameworkTTI Telecom

AccelOps & SOC-NOC ConvergenceStephen Tsuchiyama

Network Operations Center Muhannad Kalbouneh

SIEM ArchitectureNishanth Kumar Pathi

Network Operation Center Best PracticesAyehu Software Technologies Ltd.

3 Things Every Sales Team Needs to Be Thinking About in 2017Drift

How to Become a Thought Leader in Your NicheLeslie Samuel

Andere mochten auch (9)

Emergencies and on call

2015-ShowNet-報告資料

Advancing From Fault Management To Fault Resolution Framework

AccelOps & SOC-NOC Convergence

Network Operations Center

SIEM Architecture

Network Operation Center Best Practices

3 Things Every Sales Team Needs to Be Thinking About in 2017

How to Become a Thought Leader in Your Niche

Ähnlich wie Skill Set Needed to work successfully in a SOC

Career In Information securityAnant Shrivastava

WTF is Penetration TestingScott Sutherland

Dmitriy Desyatkov "Secure SDLC or Security Culture to be or not to be"WrikeTechClub

My Keynote from BSidesTampa 2015 (video in description)Andrew Case

Ryan Elkins - Simple Security Defense to Thwart an Army of Cyber Ninja WarriorsRyan Elkins

WTF is Penetration TestingNetSPI

Soc analyst course content v3ShivamSharma909

Slide Deck – Class Session 1 – FRSecure CISSP Mentor ProgramFRSecure

CNIT 160 4e Security Program Management (Part 5)Sam Bowne

Introduction To Information Systems Security 365 765Nicholas Davis

Introduction to information systems security 365 765Nicholas Davis

Paranoia 2018: A Process is No OneJared Atkinson

Careers in Cyber SecurityDeep Shankar Yadav

System Security Beyond the LibrariesEoin Woods

ISACA Ethical Hacking Presentation 10/2011Xavier Mertens

cybersecurity analyst.pptxBoni Yeamin

Reduce Third Party Developer RisksKevo Meehan

Mash f43SelectedPresentations

RightScale Webinar: Security Monitoring in the Cloud: How RightScale Does ItRightScale

Threat Hunting by Falgun Rathod - Cyber Octet Private LimitedFalgun Rathod

Ähnlich wie Skill Set Needed to work successfully in a SOC (20)

Career In Information security

WTF is Penetration Testing

Dmitriy Desyatkov "Secure SDLC or Security Culture to be or not to be"

My Keynote from BSidesTampa 2015 (video in description)

Ryan Elkins - Simple Security Defense to Thwart an Army of Cyber Ninja Warriors

WTF is Penetration Testing

Soc analyst course content v3

Slide Deck – Class Session 1 – FRSecure CISSP Mentor Program

CNIT 160 4e Security Program Management (Part 5)

Introduction To Information Systems Security 365 765

Introduction to information systems security 365 765

Paranoia 2018: A Process is No One

Careers in Cyber Security

System Security Beyond the Libraries

ISACA Ethical Hacking Presentation 10/2011

cybersecurity analyst.pptx

Reduce Third Party Developer Risks

Mash f43

RightScale Webinar: Security Monitoring in the Cloud: How RightScale Does It

Threat Hunting by Falgun Rathod - Cyber Octet Private Limited

Skill Set Needed to work successfully in a SOC

2. WHAT IS A SECURITY OPERATIONS CENTER? • An organization for computer network defense. Used to defend a computer network against unauthorized activity. • There are many other names and organization for this role such as • Computer Security Incident Response Team (CSIRT) • Computer Incident Response Team (CIRT) • Computer Incident Response Center (CIRC) • Computer Security Incident Response Center (CSIRC) • Security Operations Center (SOC) • Cybersecurity Operations Center (CSOC)

3. EXPOSURE TO IT SECURITY STANDARDS • Extensive IT Security and incident response handling experience • NIST SP 800-61 Computer Security Incident Handling Guide • SOC SOP and procedures • Agency SOC procedures “Real Knowledge is knowing the extent of one’s ignorance”

4. UNDERSTAND SOC LIFECYCLE

5. UNDERSTAND HOW NIST IS INVOLVED

6. UNDERSTAND THE BIG PICTURE

7. UNDERSTAND THE LIFESTYLE AND DEMANDS OF SOC • Daily operational needs • Always be ready for the next incident • Live in the present, past is not important • Not a project based lifestyle, live in the present • Are you ready and able to do shift work • Operations oriented • Waiting for the bad guys to attack • Fast changing environment • Constant learning • Difficult to live with for most people as it difficult and high energy demands.

8. UNDERSTAND THE ROLES IN A SOC

9. WHAT DOES A TIER 1 SOC ANALYST DO? • Observe SIEM logs and other analytic senor data points. • Curious about everything • First line of defense in the SOC • Put in the trouble tickets • Keep awake and have good customer related skills • Sometimes have to do above and beyond in times of need • Everyone starts in a SOC at tier 1 • Most SOC managers want you to start at tier 1 to learn the ropes and SOC processes • You will learn security and get a wide range of security experience

10. WHAT DOES A TIER 2 SOC ANALYST DO? • More responsibility • More research • More visible • Developing a solution set for tier 1 analysts • Managing the tier 1 analysts • More analysis and checking for patterns of malware • Work on analyzing the intrusion detection patterns • Automate repetitive tasks via scripting or automation language • Create shortcuts • Need to have decent programming skills, security knowledge and curious

11. WHAT DOES A TIER 3 SOC ANALYST DO? • Master of a particular security area • In-depth knowledge and experience in multiple areas of security • Usually have advanced security certifications like OSPF and SANS training • Work as hunters, hunting for the malware path and removal • Forensic analysis of memory, hard drive and session traffic • Most elite role in the SOC • Highly sought after security experts

12. WHAT DOES EVERYONE NEED TO DO • Teamwork • Teamwork • Teamwork

13. NEED MORE INFORMATION Read Carson Zimmerman excellent book on Cybersecurity Operations Center