Hot answers tagged

75

We just got reports that 4000 of our systems are infected with ransomeware. 3000 are end users, 800 are non-critical servers, 200 are critical servers. Triage is looking at this mess and deciding which order to start restoring systems in. We can't tackle them all at once, so we have to look at some and say 'Sorry, little Inspiron that couldn't, you get to ...


16

At a high-level, just remember that: A SIEM (Security Information and Event Management) is a specific kind of technology, providing network visibility in a security context (by indicating suspicious/illegitimate activity through set-up rules and correlation intelligence), and enabling security analysts to act on suspected threats. A SOC (Security Operations ...


14

In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it. A virus or ransomware attack would go to the operations team who would first isolate the computer to minimize collateral damage. A DDoS attack may go to the network team to start sinking the ...


8

I am an IT security professional, currently working as an IT Auditor and am very familiar with the SOC 2 attestations.To answer your question, it helps to first give a little of background into the SOC 2 program. Th SOC 2 certification is the brainchild of the AICPA and it is based on Trust Service Principles. Each Trust Principle has a defined set of ...


7

A Security Information and Event Management (SIEM), is a tool that collects and normalises logs which are tested against a set of correlation rules that when triggered creates events for human analysts to analyse. A Security Operations centre (SOC) is a centralised unit of security analysts (and related job roles) that deal with security issues, using a ...


7

In addition to the other great answers, the term triage is also used in the bugbounty bug report process to mean the process of initially reproducing the issue and assigning a priority to it. Triage The process of validating a vulnerability submission from raw submission to a valid, easily digestible report. Source: https://www.bugcrowd.com/...


3

The way this was explained to me at a very basic level is the following: Auditing refers to seeing who did what, when where, this could include systems and people. You'll probably hear the terms "audit logs" which refers to a series of logs that indicate who worked on a system, when and what they did. Compliance refers to ticking (or not) a series of ...


3

Aha! So you got the cart but forgot the horse!!!! Classic mistake -- your org seems to be in trouble, but you're not alone! Everyone else is like you, so good for asking the question. The answer, of course, starts with people and processes. You need people with the following knowledge, skills, and abilities to fill in the following tasks for each set of ...


3

Threat intelligence has a common issue today which is a large volume of data generated & coming to the consuming enterprise IT set up & threat intelligence feed bundle has three different usages. Using threat intelligence data for blocking risks & unwanted connects to your communication to your enterprise setup. Using threat intelligence data to ...


3

Active responses such as dropping and ignoring requests are the only kind of automated response I've engaged in. Any commercial IPS or Web Application Firewall does this. HIDS/HIPS can be considered too, for extremely small deployments. Simple WAF rules might block the attacker for a limited time if: If the User-Agent is wget or curl or similar ...


3

Of the top of my head I wouldn’t say anything. The point of a SoC/SIEM is to bring things to the attention of a human analyst in order to evaluate the incident and decide on what actions to do next. Anything you don’t want a human to get “eyes on” should be tuned out of the SIEMs rule set. There might be certain low risk things you want to automate, for ...


3

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...


3

As a low-effort, low-yield approach; could you simply put out a note reminding people not to use personal NAS for business backups? Knowing the risks of being caught with unauthorised material will surely deter at least some people whilst a more formalised technical solution is found?


2

I would advise taking the job. Security is a difficult field to get into without experience, and a few years of security operations experience will make you much better qualified for penetration testing jobs that may become available.


2

When speaking of Compliance and Auditing one always has to define the respective scope. A system, a process or a control can't just be compliant. It always is compliant with something. To quote from Wikipedia: Regulatory compliance describes the goal that organizations aspire to achieve in their efforts to ensure that they are aware of and take steps to ...


2

@Florin Coada has one good explanation. I like to think of it as this: Compliance deals with the state of things. Auditing deals with actions taken on things. Compliance looks ahead, auditing looks back. Let's say that there is a security issue - a terminated employee's account is not deleted in time and is accessed. Data is leaked. Compliance would ...


2

This is pretty loaded and will likely be dependent on your organization and business vertical. For instance, your organization may be interested in receiving monthly reports on failed logins for executives, but some orgs may not care about that (for various reasons...). In general though you will likely want to receive a number of reports, such as: 1) A ...


1

You need to read the job descriptions carefully as every company slices these things differently. Different shops mix terms up different ways. That said (IME): NOC: Network Operations Center: Concerned primarily with networking operations, focused on route/switch/wlan, with security as a secondary function. SOC: Security Operations Center: Concerned ...


1

If you are looking for job titles, then the one you used as a tag is the most relevant: penetration tester. SOCs and NOCs might not do any 'hacking' at all.


1

The whole point to threat feeds and threat news is to determine if those threats are relevant to you. No outside source can make that determination for you. The idea is to perform a risk assessment. It's all about risk. Assuming that the listed threat is very likely (or certain), is your system/organisation vulnerable to that threat? Do you have ...


1

I have plenty of bookmarks to check and confirm the information. Here is some of the good ones to check the latest updates: https://www.securitymagazine.com/ https://www.securityfocus.com/ https://secuniaresearch.flexerasoftware.com/community/research/ https://www.cisecurity.org/ https://www.hackerstorm.co.uk/ https://www.nist.gov/topics/cybersecurity https:/...


1

Although FIRST, SANS, and many other sources claim that Tiers of Analyst (L1/Alert, L2/Triage, L3/Investigation, et al) are a good way to structure SOCs in order to get to reasonable outcomes, there is heavy evidence that this is a poorly-constructed concept that does not lead to desired outcomes -- and it does not allow for repeatable outcomes, increases in ...


1

It really depends on the SOC and how it structures it team. In the real world Level 1, 2 and 3 analysts may be expected to build parsers/connectors to normalise logs for the SIEM. Given the descriptions in your question however I would say that none of these roles are right. The role I would expect to be handle this task would be a Technical Lead. Someone ...


1

NMS is a management tool of NOC same as SIEM solution is the Management tool of a SOC. SIEM provides an additional layer of security to a SOC which helps organizations enable advanced threat detection and incident response capabilities. While A SOC comprises of all entities which are used for security monitoring within corporate IT environment like people, ...


1

In order to be HIPAA compliant, you should have verified a substantial amount of your configuration is properly secured, otherwise you or your client will be subject to the financial penalties which come with HIPAA. My suggestion would be to go back to whoever handled your HIPAA compliance testing and ask which certifications you are closest to, and proceed ...


1

That entire depends on what certification you are looking for. If you are looking to become PCI-DSS compliant as well, you have companies that will walk you through the process/ do the certification for you.


1

You would be better served by looking for how much experience the person has in auditing the Trust Principles contained within a SOC 2 - Security, Confidentiality, Availability, Privacy, and Processing Integrity. I am working in the IT Security profession as an IT Auditor and it has been my experience that experience matters more than any particular ...


1

SIEM is nothing more than a central repo for all your monitoring systems (NIDS/HIDS) to report to. Grant it provides certain benefits but as you stated cost and deployment is rather large. You don't buy a SIEM because your boss heard SIEM from a vendor, and thought hey we should have that. You buy them when the system grows to a size where it becomes more ...


1

1) Initial Response can be taking the particular module/section of page offline or patch it on IPS or WAF. After that you should check the same yourself first with any web-proxy like Burpsuite or ZAP, if the reported vulnerability is false-positive or a real threat. You can also use a tool called SQLMAP to reduce the effort in verification. 2) For ...


1

I wish setting up a SOC was that simple. I have experience setting up an MSSP where we provided SOC as a Service to numerous clients and helped some of the clients to set up their own SOC. The questions you are asking look great but they are mostly covering just the technical part of the SOC setup. Secondly, it is going to take lots of patience and time to ...


Only top voted, non community-wiki answers of a minimum length are eligible