Hot answers tagged

75

We just got reports that 4000 of our systems are infected with ransomeware. 3000 are end users, 800 are non-critical servers, 200 are critical servers. Triage is looking at this mess and deciding which order to start restoring systems in. We can't tackle them all at once, so we have to look at some and say 'Sorry, little Inspiron that couldn't, you get to ...


14

In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it. A virus or ransomware attack would go to the operations team who would first isolate the computer to minimize collateral damage. A DDoS attack may go to the network team to start sinking the ...


13

At a high-level, just remember that: A SIEM (Security Information and Event Management) is a specific kind of technology, providing network visibility in a security context (by indicating suspicious/illegitimate activity through set-up rules and correlation intelligence), and enabling security analysts to act on suspected threats. A SOC (Security Operations ...


8

I am an IT security professional, currently working as an IT Auditor and am very familiar with the SOC 2 attestations.To answer your question, it helps to first give a little of background into the SOC 2 program. Th SOC 2 certification is the brainchild of the AICPA and it is based on Trust Service Principles. Each Trust Principle has a defined set of ...


7

In addition to the other great answers, the term triage is also used in the bugbounty bug report process to mean the process of initially reproducing the issue and assigning a priority to it. Triage The process of validating a vulnerability submission from raw submission to a valid, easily digestible report. Source: https://www.bugcrowd.com/...


5

A Security Information and Event Management (SIEM), is a tool that collects and normalises logs which are tested against a set of correlation rules that when triggered creates events for human analysts to analyse. A Security Operations centre (SOC) is a centralised unit of security analysts (and related job roles) that deal with security issues, using a ...


3

Active responses such as dropping and ignoring requests are the only kind of automated response I've engaged in. Any commercial IPS or Web Application Firewall does this. HIDS/HIPS can be considered too, for extremely small deployments. Simple WAF rules might block the attacker for a limited time if: If the User-Agent is wget or curl or similar ...


3

Of the top of my head I wouldn’t say anything. The point of a SoC/SIEM is to bring things to the attention of a human analyst in order to evaluate the incident and decide on what actions to do next. Anything you don’t want a human to get “eyes on” should be tuned out of the SIEMs rule set. There might be certain low risk things you want to automate, for ...


3

The way this was explained to me at a very basic level is the following: Auditing refers to seeing who did what, when where, this could include systems and people. You'll probably hear the terms "audit logs" which refers to a series of logs that indicate who worked on a system, when and what they did. Compliance refers to ticking (or not) a series of ...


3

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...


2

You should log everything and analyze anything. People trying to brute your sites and servers. All of these are relevant incidents as they pose a threat. It's not relevant to say to what is an incident, as every attempt might be a relevant event some time. What is important is to catalog them with different levels. Some threats pose greater danger than ...


2

When speaking of Compliance and Auditing one always has to define the respective scope. A system, a process or a control can't just be compliant. It always is compliant with something. To quote from Wikipedia: Regulatory compliance describes the goal that organizations aspire to achieve in their efforts to ensure that they are aware of and take steps to ...


2

@Florin Coada has one good explanation. I like to think of it as this: Compliance deals with the state of things. Auditing deals with actions taken on things. Compliance looks ahead, auditing looks back. Let's say that there is a security issue - a terminated employee's account is not deleted in time and is accessed. Data is leaked. Compliance would ...


2

Threat intelligence has a common issue today which is a large volume of data generated & coming to the consuming enterprise IT set up & threat intelligence feed bundle has three different usages. Using threat intelligence data for blocking risks & unwanted connects to your communication to your enterprise setup. Using threat intelligence data to ...


2

This is pretty loaded and will likely be dependent on your organization and business vertical. For instance, your organization may be interested in receiving monthly reports on failed logins for executives, but some orgs may not care about that (for various reasons...). In general though you will likely want to receive a number of reports, such as: 1) A ...


1

The whole point to threat feeds and threat news is to determine if those threats are relevant to you. No outside source can make that determination for you. The idea is to perform a risk assessment. It's all about risk. Assuming that the listed threat is very likely (or certain), is your system/organisation vulnerable to that threat? Do you have ...


1

I have plenty of bookmarks to check and confirm the information. Here is some of the good ones to check the latest updates: https://www.securitymagazine.com/ https://www.securityfocus.com/ https://secuniaresearch.flexerasoftware.com/community/research/ https://www.cisecurity.org/ https://www.hackerstorm.co.uk/ https://www.nist.gov/topics/cybersecurity https:/...


1

Aha! So you got the cart but forgot the horse!!!! Classic mistake -- your org seems to be in trouble, but you're not alone! Everyone else is like you, so good for asking the question. The answer, of course, starts with people and processes. You need people with the following knowledge, skills, and abilities to fill in the following tasks for each set of ...


1

Although FIRST, SANS, and many other sources claim that Tiers of Analyst (L1/Alert, L2/Triage, L3/Investigation, et al) are a good way to structure SOCs in order to get to reasonable outcomes, there is heavy evidence that this is a poorly-constructed concept that does not lead to desired outcomes -- and it does not allow for repeatable outcomes, increases in ...


1

It really depends on the SOC and how it structures it team. In the real world Level 1, 2 and 3 analysts may be expected to build parsers/connectors to normalise logs for the SIEM. Given the descriptions in your question however I would say that none of these roles are right. The role I would expect to be handle this task would be a Technical Lead. Someone ...


1

NMS is a management tool of NOC same as SIEM solution is the Management tool of a SOC. SIEM provides an additional layer of security to a SOC which helps organizations enable advanced threat detection and incident response capabilities. While A SOC comprises of all entities which are used for security monitoring within corporate IT environment like people, ...


1

You need to read the job descriptions carefully as every company slices these things differently. Different shops mix terms up different ways. That said (IME): NOC: Network Operations Center: Concerned primarily with networking operations, focused on route/switch/wlan, with security as a secondary function. SOC: Security Operations Center: Concerned ...


1

If you are looking for job titles, then the one you used as a tag is the most relevant: penetration tester. SOCs and NOCs might not do any 'hacking' at all.


1

You would be better served by looking for how much experience the person has in auditing the Trust Principles contained within a SOC 2 - Security, Confidentiality, Availability, Privacy, and Processing Integrity. I am working in the IT Security profession as an IT Auditor and it has been my experience that experience matters more than any particular ...


1

SIEM is nothing more than a central repo for all your monitoring systems (NIDS/HIDS) to report to. Grant it provides certain benefits but as you stated cost and deployment is rather large. You don't buy a SIEM because your boss heard SIEM from a vendor, and thought hey we should have that. You buy them when the system grows to a size where it becomes more ...


1

1) Initial Response can be taking the particular module/section of page offline or patch it on IPS or WAF. After that you should check the same yourself first with any web-proxy like Burpsuite or ZAP, if the reported vulnerability is false-positive or a real threat. You can also use a tool called SQLMAP to reduce the effort in verification. 2) For ...


1

I would advise taking the job. Security is a difficult field to get into without experience, and a few years of security operations experience will make you much better qualified for penetration testing jobs that may become available.


1

It depends on source of logs! If logs source is windows then look for account logon failures, password reset or change attempt, deletion or creation of new account, conflict in hostnames. You can visit ultimatewindowssecurity where you can find critical events to look for. In firewall logs you can check for port scan (one host ip visiting more than 100 ...


1

As the others mentioned this can only be established when you know more requirements. These might include but not be limited to: Region 24x7? scale/type of work involved. (I.e. how much work/ how often ?) For a rough idea you could sketch out how the current incidents you mentioned would've been ideally dealt with, and how much work this would've taken ...


Only top voted, non community-wiki answers of a minimum length are eligible