Presented at Total Security Conference 2018 in Singapore. This presentation is "Advanced SOC 101" that you need to get in place in order to make it harder for your adversaries.

1. Enabling Early Detection of
Advanced Persistent Threat
(APT): Tools, Techniques and
Processes
Tomasz Jakubowski

2. Security Team
You need a security team. Get over it

3. Deming
cycle

4. PLAN: People
Look for a spark, not certificates

5. PLAN: People
Get some external training but foster continuous training

6. PLAN: Processes
To speed up - get some external help

7. PLAN: Processes
Define what your crown jewels are.
Let the business drive that decision

8. PLAN: Tools
Know your systems – Configuration DB
Gather logs
Have network (pcap, metadata) and endpoint (logs, forensics) capabilities

9. Formal training, mentors (seniors to junior analysts), conferences,
encourage own hobby and interests, brown-bag sharing sessions
DO: People

10. DO: Processes
Monitor, gather logs

11. Patch your systems
DO: Processes

12. Follow-the-Sun, incident handover
DO: Processes

13. DO: Tools
Automate as much as you can through scripts etc.

14. CHECK: People
Analyst assessments – more to teach how others do
it, rather than to grade people

15. CHECK: Processes
AAR after each bigger incident

16. CHECK: Tools
Measure which stopped incidents, which would stop
(further in the chain or potential future technology)

17. ACT
Implement improvements

19. Contact
• Tomasz Jakubowski
• Twitter: @perunhimself
• LinkedIn: https://www.linkedin.com/in/jakubowski/
• Images © Kreivoplan.com