Downloaded 71 times
Uploaded byPriyanka Aash
Building a World-Class Proactive Integrated Security and Network Ops Center
The document outlines strategies for building a proactive Integrated Security and Network Operations Center (SNOC) by transitioning existing Network Operations Center (NOC) teams and focusing on team optimization, management support, and tool utilization. It emphasizes the importance of team character, culture fit, and collaboration across departments, while providing a framework for incident response and operational excellence. Additionally, it addresses security challenges and solutions, recommending the use of existing resources to enhance security measures and overall performance.
More Related Content
Similar to Building a World-Class Proactive Integrated Security and Network Ops Center
Building a World-Class Proactive Integrated Security and Network Ops Center
- 1. SESSION ID: #RSAC Hanna SickerCISM, CISSP Building a World-Class Proactive Integrated Security & Network Operations Center SNOC AIR-T11 Security & Network Operations SNOC Sr. Mgr. StubHub/eBay @snocgirl
- 2. #RSAC Operations Leaders (Security& Network)
- 3.
- 4.
- 5. #RSAC SNOC Impact onUptime & CSS Year 2011 Year 2012 Year 2013 Year 2014 Year 2015 99.95% 99.97% 99.99%99.90% 98.00% CSS * CSS: Customer Satisfaction Score
- 6.
- 7. #RSAC Typical NOC &SOC Challenges
- 8. #RSAC How We Overcamethe Challenges
- 9. #RSAC Break the Rules Say“NO” to Traditional Tiered Model
- 10. #RSAC SNOC IRP (IncidentResponse Process) Visibility Detection Analysis Investigation Response Remediation SLA Change Mgt. Process
- 11.
- 12.
- 13.
- 14. #RSAC Proactive Integrated SNOCFramework Mgt. Team Tools BIC Services Reports Reinvest Recognize Enable
- 15.
- 16. #RSAC Detailed SNOC Framework– Team Stage 1 • Quick impact - utilize the existing structure Stage 2 • Optimize & emphasize on quality Stage 3 • Identify & hire talent Stage 4 • Empower the team & remove the tiers Stage 5 • Team development life cycle - TDLC
- 17. #RSAC Stage 1 –Quick Impact (2 mo.)
- 18. #RSAC Stage 2 –Optimize & Emphasize on Quality
- 19. #RSAC Stage 3 –Identify & Hire Talent Round out the team puzzle
- 20. #RSAC Stage 4 –Empower the Team
- 21. #RSAC Stage 5 -Team Development Life Cycle - TDLC Train Mentor Coach Hire Talent Process Cross Train Enable Engage Quality
- 22. #RSAC Detailed SNOC Framework– Tools Stage 1 • Utilize Stage 2 • Optimize Stage 3 • Automate
- 23.
- 24. #RSAC SNOC Framework –BIC Services Our Formula BIC Services = Business Objectives = Customer Satisfaction Score (CSS) + Revenue ($) + Team Defined Goals (*APS) APS = Availability + Performance + Security Quick results without initial Mgt support = Team + Existing Tools + Reports
- 25. #RSAC SNOC Framework –Management Our Formula Increased demonstrated value = increased Mgt support (IMS) IMS = Recognition + Reinvestment
- 26. #RSAC Our Key toSuccess
- 27.
- 28. #RSAC Right Architecture -Security Layers 3rd Parties Tokenization Fraud detection WAF Client reputation Customized rules Bot detection IDS IPS SIEMPacket capture Bot detection WAF Vulnerability mgt. Fraud protection Data Activity Monitoring Log mgt.
- 29. #RSAC Use Case –Reducing ATOs
- 30. #RSAC SNOC Benefits &Future Challenges
- 31. #RSAC Apply If you arein the process of building a SOC, and you have an existing NOC, utilize your existing NOC team and transition them to become SNOC. Recognize similar functions between NOC & SOC and combine them. Before obtaining Mgt. commitment, focus on your team as the core component to build successful SNOC.
- 32. #RSAC Apply When you addnew members, focus on character and culture fit. Try to round out the team puzzle. Do not pay for expertise; grow your own (entry level but highly motivated and trainable). Lead from the front Build alliances with other teams across all departments & learn from their key players.
- 33. #RSAC Apply Understand your businessgoals, traffic and users. Filter your traffic at the edge and protect at all layers. Shield your data center - If your business does B2C then any cloud services who host businesses can be blocked. If your clients are within a specific geographic area, then block all other countries/areas that you do not do business with. To reduce ATOs & attacks, create WAF rules based on your traffic & customers’ behavior.
- 34. #RSAC Apply – Cont. Utilize& optimize your and other teams’ existing tools. If no tools are available, then automate processes using scripts written by one of your own or another team’s members. Tune out false positive alerts and train the team to tune and modify the thresholds. Check if the NOC has tools that are applicable for SOC usage. Example: If the NOC is using a network performance monitoring tools, check to see if the tools can perform full packet capture.
- 35. #RSAC Let’s work together Mycontact info: Hanna Sicker hsicker@stubhub.com Twitter: @SNOCgirl