Cyber-Security-Monitoring-Guide

More documents

Recommendations

Info

Cyber Security Monitoring and Logging GuideSOC servicesIf you decide to use a SOC (either outsourced or developed internally) the services of the SOC should be customised to yourthreat landscape and data assets to enable a targeted analysis of data based on your organisation’s security objectives.You should also make sure that, where required, your SOC:• Accumulates all relevant traffic entering and leaving your network for a fixed duration• Analyses all captured data, putting it into context using situational awareness - forensically sound capture files canbe retained should evidence be required• Alerts you to certain events or trends in real-time by capturing data across multiple capture locations and analysing itin numerous dimensions• Reports evidence of real events and actual incidents, sophisticated attack detection – including infiltration andexfiltration incidents, corporate or third party security policy violations, and specific compliance non-conformities• Enables effective remediation of cyber security incidents• Assesses both the general health and security posture of your organisation at network level as well as theeffectiveness of existing cyber security controls.“A good SOC should not just be a detection centre”Many major SOC offerings run 24/7 every day of the year, providing a wide rangeof commercial services. They deliver a ’service wrap’ of offerings for their clients,effectively integrating a wide range of technical security services.People, process, technology and informationAny SOC needs to be supported by the right blend of people, process, technology and information, as outlined in Figure 9below.PROCESSPEOPLETECHNOLOGYCYBERSECURITYINCIDENT110101010010101000101111101010100101010001010100010101010001010101000010101010101010100010101010001010101011101010100010010100010001001001010101011101010100101010001011111010101001010100010101000101010100010101010000101010101010101000101010100010101010111010101000100101INFORMATIONFigure 9: Main considerations for each phase of the cyber security monitoring and logging process38
Cyber Security Monitoring and Logging GuideWorkshop attendees determined how four different types of individual in the SOC (there can be more roles) wouldtypically use processes, technologies and information to help them carry out their roles effectively. The results of thisanalysis are presented in the table below, illustrating how various roles (shown in the people column) are supportedby processes, technology and information.People Process Technology InformationTechnical deliverymanager• Reporting• Client relations• Collation of information• Compliance• Reporting• Analytics• Commercial understandingFirst line analysts• Event filtering• Collation of information• Alert/alarm monitoring• Escalation of alerts/alarms• Ticket management• Initial customer contact• Log management tools• SIEM tools• Ticketing• Knowledge base• Customer relationshipmanagement (CRM)• Configuration managementdatabase (CMDB)• Customer• Asset• Alerts• Alarms• EventsSecond line analysts• Incident assessment• Trend analysis• Root causes analysis• Deep dive investigations• Escalation to third lineanalysts• Incident lifecyclemanagement• Alarm configuration• Production of metrics• Contact with key assets• Threat intelligence• Customer• Asset• Alerts• Alarms• Events• Customer profile• First line evidenceThird line analyst(very technical,incident response)• Host intrusion analysis• Malware analysis• Network intrusion analysis• Specialist toolsSOC Manager• SOC process• Team management• Production of SOC metrics• Career progression• SOC validation of PPTI• Point of escalation• Capacity management• Compliance• Ticketing• Reporting• Incident management• HR systems• Tools for metricsSecurity engineers, system administrators and marketing executives are omitted from the SOC analysis because,rather than being an integral part of the SOC itself, these roles sit outside the SOC, supporting it, for example interms of marketing, pre-sales and infrastructure services.39
Page 1: Cyber SecurityMonitoring and Loggin
Page 4 and 5: Cyber Security Monitoring and Loggi
Page 60: The quadrants in this diagram outli

Cyber-Security-Monitoring-Guide

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?