Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideInformationIt is essential to make sure that any SOC has the information readily available that will help the cyber securitymonitoring and logging process.The amount and type of information required in a SOC will differ based on a numberof factors, such as its size, market sector, internal capabilities and nature of theparticular cyber security monitoring and logging services provided.Most respondents to the project survey had a high level of support for many types of information being used in aSOC, with the top five being:• Source inputs/material, such as vulnerability management; risk assessments; and SIEM monitoring• Security incident response teams (SIRT)• Intelligence and analysis (eg. a security risk register; security operations; and threat intelligence)• Management information (strategic and tactical reports) such as current risk and trends; threat and horizon scanning;operational metrics; and programme status• Tailor-made internal intelligence data.!Organisations can overlook the need to gain fast access to cyber security-relatedevents at their outsourced service providers (ie. access to premises or equipment).They often have difficulties in getting their third party suppliers (eg. cloud servicesuppliers, infrastructure outsourcers and managed service providers) to provideimportant information (eg. event logs) pertaining to cyber security events,sometimes having to wait for several days for something to be actioned.45