Membangun Security Operation Center
•
0 likes•125 views
Dokumen tersebut membahas tentang tipe dan tanggung jawab analis keamanan siber di SOC dengan tiga tingkatan keahlian berbeda. Selain itu, dokumen tersebut juga menjelaskan arsitektur dan komponen penting dalam SOC seperti sensor, log management, correlation engine, dan response system serta strategi pembangunan SOC secara in-house atau outsourced.
Report
Share
Report
Share
Download to read offline
Recommended
Déclaration d'applicabilité (DdA) - ISO27002:2013
Version française traduite du document intitulé "ISO27k Statement of Applicability (SOA)" de la trousse à outils ISO27k ("ISO27k Toolkit"), compatible avec ISO 27002:2013 .
Version 3 January 2009
Copyright © 2009
ISO27k Implementers’ Forum
www.ISO27001security.com
Welcome to the world of Cyber Threat Intelligence
Title: Welcome to the world of Cyber Threat Intelligence!
Abstract: Welcome to the world of Cyber Threat Intelligence (CTI)! During this presentation, we will discuss about some of the basic concepts within CTI domain and we will have a look at the current threat landscape as observed from the trenches. The presentation is split into 3 parts: a) Intro to CTI, b) A view at the current threat landscape, and c) CTI analyst skillset.
Short Bio: Andreas Sfakianakis is a Cyber Threat Intelligence and Incident Response professional and works for Standard and Poors' CTI team. He is also a member of ENISA’s CTI Stakeholders’ Group and Incident Response Working Group. He is the author of a number of CTI reports and an instructor of CTI. In the past, Andreas has worked within the Financial and Oil & Gas sectors as well as an external reviewer for European Commission. Andreas' Twitter handle is @asfakian and his website is www.threatintel.eu
SIEM and Threat Hunting
This document provides an overview of security operation centers (SOCs), security information and event management (SIEM) tools, threat hunting, and related concepts. It defines SOCs as facilities that monitor and analyze an organization's security posture using technology and processes. SIEM tools are listed that help with this. Threat hunting is described as investigating security incidents to uncover new tactics, techniques and procedures (TTPs) used by attackers. The Cyber Kill Chain model and common indicators used to detect compromises like IOCs and IOAs are also summarized.
IBM QRadar Security Intelligence Overview
the IBM Security Intelligence Platform, also known as QRadar®, integrates SIEM, log management, anomaly detection, vulnerability management, risk management and incident forensics into a unified, highly scalable, real-time solution that provides superior threat detection, greater ease of use, and low total cost of ownership compared with competitive products
Windows Threat Hunting
This document discusses techniques for threat hunting on Windows systems. It covers key areas to focus on during incident triage like processes, network connections, filesystem artifacts and logs. It also describes general hunting scenarios using threat intelligence or without intelligence. Specific techniques and artifacts discussed include the Windows Task Scheduler, ShimCache, AmCache, RecentFileCache, rogue services, timeline analysis using MFT, DLL side loading, DLL injection rootkits, autoruns, and the Wdigest credential storage downgrade attack. The document provides details on what to look for and analyze to effectively hunt for threats on Windows.
Financial Services Forum_New York, May 17, 2017
The document outlines an upcoming presentation by Splunk on how their software can help financial institutions meet the compliance requirements of the New York State Department of Financial Services' new cybersecurity regulations. It notes that the presentation will contain forward-looking statements and that any information provided is subject to change. Splunk software functionalities that could help with compliance like security monitoring, analytics, and audit logging are highlighted.
Threat Hunting Procedures and Measurement Matrice
This document will provide the basics of Cyber Threat Hunting and answers of some Q such as; What is Threat Hunting?, What is the Importance of Threat Hunting, and How it can be start....Bla..Bla..Bla...
Recommended
Déclaration d'applicabilité (DdA) - ISO27002:2013
Version française traduite du document intitulé "ISO27k Statement of Applicability (SOA)" de la trousse à outils ISO27k ("ISO27k Toolkit"), compatible avec ISO 27002:2013 .
Version 3 January 2009
Copyright © 2009
ISO27k Implementers’ Forum
www.ISO27001security.com
Welcome to the world of Cyber Threat Intelligence
Title: Welcome to the world of Cyber Threat Intelligence!
Abstract: Welcome to the world of Cyber Threat Intelligence (CTI)! During this presentation, we will discuss about some of the basic concepts within CTI domain and we will have a look at the current threat landscape as observed from the trenches. The presentation is split into 3 parts: a) Intro to CTI, b) A view at the current threat landscape, and c) CTI analyst skillset.
Short Bio: Andreas Sfakianakis is a Cyber Threat Intelligence and Incident Response professional and works for Standard and Poors' CTI team. He is also a member of ENISA’s CTI Stakeholders’ Group and Incident Response Working Group. He is the author of a number of CTI reports and an instructor of CTI. In the past, Andreas has worked within the Financial and Oil & Gas sectors as well as an external reviewer for European Commission. Andreas' Twitter handle is @asfakian and his website is www.threatintel.eu
SIEM and Threat Hunting
This document provides an overview of security operation centers (SOCs), security information and event management (SIEM) tools, threat hunting, and related concepts. It defines SOCs as facilities that monitor and analyze an organization's security posture using technology and processes. SIEM tools are listed that help with this. Threat hunting is described as investigating security incidents to uncover new tactics, techniques and procedures (TTPs) used by attackers. The Cyber Kill Chain model and common indicators used to detect compromises like IOCs and IOAs are also summarized.
IBM QRadar Security Intelligence Overview
the IBM Security Intelligence Platform, also known as QRadar®, integrates SIEM, log management, anomaly detection, vulnerability management, risk management and incident forensics into a unified, highly scalable, real-time solution that provides superior threat detection, greater ease of use, and low total cost of ownership compared with competitive products
Windows Threat Hunting
This document discusses techniques for threat hunting on Windows systems. It covers key areas to focus on during incident triage like processes, network connections, filesystem artifacts and logs. It also describes general hunting scenarios using threat intelligence or without intelligence. Specific techniques and artifacts discussed include the Windows Task Scheduler, ShimCache, AmCache, RecentFileCache, rogue services, timeline analysis using MFT, DLL side loading, DLL injection rootkits, autoruns, and the Wdigest credential storage downgrade attack. The document provides details on what to look for and analyze to effectively hunt for threats on Windows.
Financial Services Forum_New York, May 17, 2017
The document outlines an upcoming presentation by Splunk on how their software can help financial institutions meet the compliance requirements of the New York State Department of Financial Services' new cybersecurity regulations. It notes that the presentation will contain forward-looking statements and that any information provided is subject to change. Splunk software functionalities that could help with compliance like security monitoring, analytics, and audit logging are highlighted.
Threat Hunting Procedures and Measurement Matrice
This document will provide the basics of Cyber Threat Hunting and answers of some Q such as; What is Threat Hunting?, What is the Importance of Threat Hunting, and How it can be start....Bla..Bla..Bla...
Cyber Threat Intelligence
The document discusses cyber threat intelligence and collaborative threat intelligence. It provides an overview of malware trends, requirements for developing threat intelligence capabilities, and principles for managing threat intelligence proactively. The document advocates for a collaborative threat intelligence framework to enable preventative response by identifying and blocking known attackers across multiple organizations through automated and real-time threat information sharing. Standards and tools discussed include IODEF, CIF and how CIF can be used to gather, identify, respond to and mitigate threats based on indicators collected from various sources.
The Next Generation of Security Operations Centre (SOC)
The document discusses the key aspects of building a next generation Security Operations Centre (SOC). It emphasizes that skilled people, well-defined processes, and integrating new technologies are critical. Specifically, it recommends adopting automation and analytics to analyze large datasets, integrating threat intelligence from multiple sources, and establishing red and blue teams to continuously test defenses. The goal of a next generation SOC is to use predictive analysis of vast security data to improve threat detection, response, and the overall security posture of an organization.
Bsides 2019 - Intelligent Threat Hunting
This document outlines an overview of intelligent threat hunting presented by Dhruv Majumdar. It discusses the basics of threat hunting, including that it is a proactive and iterative process to detect threats that evade existing security solutions. It provides a threat hunting recipe and describes important data sources and skills needed like host analysis, network analysis, and threat intelligence. It also walks through an attack scenario and things to look for at different stages of an attack lifecycle. Finally, it concludes with the growing demand for threat hunters and recommendations on how to get started with threat hunting.
Threat Hunting with Splunk Hands-on
The document discusses threat hunting techniques using Splunk, including an overview of threat hunting basics, data sources for threat hunting, and Lockheed Martin's Cyber Kill Chain model. It provides examples of using endpoint data to hunt for threats across the kill chain by analyzing processes, communications, and file artifacts in a demo dataset. Advanced techniques discussed include hunting for SQL injection attacks and lateral movement.
NIST Cybersecurity Framework 101
Presentation for March 2017 webcast by NIST.
www.nist.gov/cyberframework
Webcast video: https://www.nist.gov/news-events/events/2017/03/cybersecurity-framework-virtual-events
This presentation introduces the audience to the Framework for Improving Critical Infrastructure Cybersecurity (“The Framework”). It provides a brief history about why and how the Framework was developed, and an understanding of each of the three primary Framework components (the Core, Implementation Tiers, and Profiles). It covers potential benefits of Framework, and how the Framework can be used. It highlights industry resources, progress in Roadmap areas, and future direction of the Framework program.
Analyse de risques en cybersécurité industrielle
Principes du contrôle commande, méthodes d'analyse standard et limites, justification d'approches pragmatiques par l'actualité (octobre 2011).
Réalisé avant que DuQu soit rendu public, mais donc d'autant plus pertinent à présent.
Cloud Summit Canada com Rodrigo Montoro
Entre os dias 04/10 e 06/10, nosso head de Threat & Detection Research e Security Content Lead, Rodrigo Montoro, representou a Clavis em mais uma importante apresentação em Toronto no Canadá. No dia 04/10 ele palestrou no Cloud Summit e no dia 06/10 na Sector.
Montoro, apresentou as palestras "The Default Truth Of AWS Shared Responsability Model" e "Understanding, Abusing and Monitoring AWS Appstream 2.0", onde abordou a importância de entender os padrões que o provedor da nuvem proporciona, bem como pesquisar sobre serviços de uso mais incomuns e fora dos grande "holofotes".
A abordagem das duas palestras busca justamente desmitificar um pouco do modelo de responsabilidade compartilhada e configurações iniciais da nuvem e a segunda o entendimento de um serviço não tao comumente utilizado e seus perigos. Como exemplo, compartilhou importantes resultados obtidos após pesquisa de vulnerabilidades no serviço Amazon AppStream 2.0, da Amazon Web Services (AWS).
Proactive Threat Hunting: Game-Changing Endpoint Protection Beyond Alerting
Falcon OverWatch Experts Hunt 24/7 To Stop Incidents Before They Become Breaches
Is your IT security team suffering from alert fatigue? For many organizations, chasing down every security alert can tax an already overburdened IT department, often resulting in a breach that might have been avoided. Adding to this challenge is an increase in sophisticated threats that strike so fast and frequently, traditional methods of investigation and response can’t offer adequate protection.
A new webcast from CrowdStrike, “Proactive Threat Hunting: Game-Changing Endpoint Protection Above and Beyond Alerting,” discusses why so many organizations are vulnerable to unseen threats and alert fatigue, and why having an approach that is both reactive and proactive is key. You’ll also learn about Falcon OverWatch™, CrowdStrike’s proactive threat hunting service that investigates and responds to threats immediately, dramatically increasing your ability to react before a damaging breach occurs.
Download the webcast slides to learn:
--How constantly reacting to alerts prevents you from getting ahead of the potentially damaging threats designed to bypass standard endpoint security
--Why an approach that includes proactive threat hunting, sometimes called Managed Detection and Response, is key to increasing protection against new and advanced threats
--How CrowdStrike Falcon OverWatch can provide 24/7 managed threat hunting, augmenting your security efforts with a team of cyber intrusion detection analysts and investigators who proactively identify and prioritize incidents before they become damaging breaches
PCI DSS Implementation: A Five Step Guide
Payment Card Industry Data Security Standard (PCI DSS) compliance can be both hard and expensive. For most small to medium sized organizations, it doesn’t have to be as long you have the right plan and tools in place. In this guide you’ll learn five steps that you can take to implement and maintain PCI DSS compliance at your organization.
AlienVault PCI DSS Compliance:
https://www.alienvault.com/solutions/pci-dss-compliance
Have a question? Ask it in our forum:
http://forums.alienvault.com
More videos: http://www.youtube.com/user/alienvaulttv
AlienVault Blogs: http://www.alienvault.com/blogs
AlienVault: http://www.alienvault.com
Windows logging cheat sheet
The Windows Logging Cheat Sheet is the definitive guide on learning where to start with Windows Logging. How to Enable, Configure, Gather and Harvest events so you can catch a hacker in the act.
RSA 2016 Security Analytics Presentation
This presentation discusses security analytics, including defining the concept, choosing a path to success, tooling options, and best practices. Security analytics involves analyzing data using advanced methods to achieve useful security outcomes, such as detecting threats better or prioritizing alerts. Success requires an analytic mindset and willingness to explore data. Options for tooling include buying pre-built solutions, building custom capabilities, or partnering with outside experts. The presenter provides examples of user behavior analytics and network traffic analysis tools.
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
Learn about Sogeti’s journey of creating a new Security Operation Center, and how and why we leveraged QRadar solutions. We explore the full program lifecycle, from strategic choices to technical analysis and benchmarking on the product. We explain how QRadar accelerates the go-to-market of the SOC, and how we embed IBM Security Intelligence offerings in our solution. Having a strong collaboration between different IBM stakeholders such as Software Group, Global Technology Services, as well as the Labs, was key to client satisfaction and operational effectiveness. We also show the value of integrating new QRadar features in our SOC roadmap, in order to constantly stay ahead in the cyber security game.
PCI DSS
This document provides an introduction to PCI-DSS (Payment Card Industry Data Security Standard). It defines key terms like PCI, cardholder data, and sensitive authentication data. It explains why PCI security standards are important to protect payment card data and prevent fraud. The document outlines the six goals and twelve requirements of PCI-DSS, as well as introducing PA-DSS which focuses on developing secure payment applications. It provides instructions on determining an organization's PCI compliance level and selecting the appropriate Self Assessment Questionnaire.
Cyber Threat Hunting with Phirelight
"Cyberhunting" actively looks for signs of compromise within an organization and seeks to control and minimize the overall damage. These rare, but essential, breed of enterprise cyber defenders give proactive security a whole new meaning.
Check out the accompanying webinar: http://www.hosting.com/resources/webinars/?commid=228353
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
With cybersecurity threats continuing to grow faster than security budgets, CISOs, CIOs and SecOps teams are left at a dangerous disadvantage.
Even enterprises running their own Security Operations Centers (SOCs) find the perennial shortage of skills, tools, and other resources stops them from realizing the full value of investments. Rather than struggle to find – and hang on to – top talent with hands-on experience across network and cloud security, mid-sized enterprises are instead opting for SOC-as-a-Service offerings.
Soc analyst course content
The SOC analyst training program is meticulously designed by the subject matter experts at Infosec Train. The training program offers a deep insight into the SOC operations and workflows. It is an excellent opportunity for aspiring and current SOC analysts (L1/L2/L3) to level up their skills to mitigate business risks by effectively handling and responding to security threats.
https://www.infosectrain.com/courses/soc-analyst-expert-training/
SOC Architecture Workshop - Part 1
The document discusses advanced security operations centers (A-SOCs) and their capabilities. It describes how A-SOCs go beyond traditional SOCs by focusing on threat mitigation, proactive monitoring and intelligence. It outlines key A-SOC capabilities like threat assessment and hunting, threat intelligence, situational awareness, and security analytics. The document also provides examples of A-SOC architecture, frameworks, technologies, queries, organization structure, and processes. It proposes a maturity model for advanced SOC services and provides an example use case for the Carbanak attack.
SOC 2 Type 2 Checklist - Part 1 - V2.pdf
Looking for answers related to SOC? Here's a 𝐒𝐎𝐂 𝟐 𝐓𝐲𝐩𝐞 𝟐 𝐂𝐡𝐞𝐜𝐤𝐥𝐢𝐬𝐭 to help you keep an eye out for these critical aspects in your #SOC. Don't forget to save this checklist for your SOC compliance journey!
More Related Content
What's hot
Cyber Threat Intelligence
The document discusses cyber threat intelligence and collaborative threat intelligence. It provides an overview of malware trends, requirements for developing threat intelligence capabilities, and principles for managing threat intelligence proactively. The document advocates for a collaborative threat intelligence framework to enable preventative response by identifying and blocking known attackers across multiple organizations through automated and real-time threat information sharing. Standards and tools discussed include IODEF, CIF and how CIF can be used to gather, identify, respond to and mitigate threats based on indicators collected from various sources.
The Next Generation of Security Operations Centre (SOC)
The document discusses the key aspects of building a next generation Security Operations Centre (SOC). It emphasizes that skilled people, well-defined processes, and integrating new technologies are critical. Specifically, it recommends adopting automation and analytics to analyze large datasets, integrating threat intelligence from multiple sources, and establishing red and blue teams to continuously test defenses. The goal of a next generation SOC is to use predictive analysis of vast security data to improve threat detection, response, and the overall security posture of an organization.
Bsides 2019 - Intelligent Threat Hunting
This document outlines an overview of intelligent threat hunting presented by Dhruv Majumdar. It discusses the basics of threat hunting, including that it is a proactive and iterative process to detect threats that evade existing security solutions. It provides a threat hunting recipe and describes important data sources and skills needed like host analysis, network analysis, and threat intelligence. It also walks through an attack scenario and things to look for at different stages of an attack lifecycle. Finally, it concludes with the growing demand for threat hunters and recommendations on how to get started with threat hunting.
Threat Hunting with Splunk Hands-on
The document discusses threat hunting techniques using Splunk, including an overview of threat hunting basics, data sources for threat hunting, and Lockheed Martin's Cyber Kill Chain model. It provides examples of using endpoint data to hunt for threats across the kill chain by analyzing processes, communications, and file artifacts in a demo dataset. Advanced techniques discussed include hunting for SQL injection attacks and lateral movement.
NIST Cybersecurity Framework 101
Presentation for March 2017 webcast by NIST.
www.nist.gov/cyberframework
Webcast video: https://www.nist.gov/news-events/events/2017/03/cybersecurity-framework-virtual-events
This presentation introduces the audience to the Framework for Improving Critical Infrastructure Cybersecurity (“The Framework”). It provides a brief history about why and how the Framework was developed, and an understanding of each of the three primary Framework components (the Core, Implementation Tiers, and Profiles). It covers potential benefits of Framework, and how the Framework can be used. It highlights industry resources, progress in Roadmap areas, and future direction of the Framework program.
Analyse de risques en cybersécurité industrielle
Principes du contrôle commande, méthodes d'analyse standard et limites, justification d'approches pragmatiques par l'actualité (octobre 2011).
Réalisé avant que DuQu soit rendu public, mais donc d'autant plus pertinent à présent.
Cloud Summit Canada com Rodrigo Montoro
Entre os dias 04/10 e 06/10, nosso head de Threat & Detection Research e Security Content Lead, Rodrigo Montoro, representou a Clavis em mais uma importante apresentação em Toronto no Canadá. No dia 04/10 ele palestrou no Cloud Summit e no dia 06/10 na Sector.
Montoro, apresentou as palestras "The Default Truth Of AWS Shared Responsability Model" e "Understanding, Abusing and Monitoring AWS Appstream 2.0", onde abordou a importância de entender os padrões que o provedor da nuvem proporciona, bem como pesquisar sobre serviços de uso mais incomuns e fora dos grande "holofotes".
A abordagem das duas palestras busca justamente desmitificar um pouco do modelo de responsabilidade compartilhada e configurações iniciais da nuvem e a segunda o entendimento de um serviço não tao comumente utilizado e seus perigos. Como exemplo, compartilhou importantes resultados obtidos após pesquisa de vulnerabilidades no serviço Amazon AppStream 2.0, da Amazon Web Services (AWS).
Proactive Threat Hunting: Game-Changing Endpoint Protection Beyond Alerting
Falcon OverWatch Experts Hunt 24/7 To Stop Incidents Before They Become Breaches
Is your IT security team suffering from alert fatigue? For many organizations, chasing down every security alert can tax an already overburdened IT department, often resulting in a breach that might have been avoided. Adding to this challenge is an increase in sophisticated threats that strike so fast and frequently, traditional methods of investigation and response can’t offer adequate protection.
A new webcast from CrowdStrike, “Proactive Threat Hunting: Game-Changing Endpoint Protection Above and Beyond Alerting,” discusses why so many organizations are vulnerable to unseen threats and alert fatigue, and why having an approach that is both reactive and proactive is key. You’ll also learn about Falcon OverWatch™, CrowdStrike’s proactive threat hunting service that investigates and responds to threats immediately, dramatically increasing your ability to react before a damaging breach occurs.
Download the webcast slides to learn:
--How constantly reacting to alerts prevents you from getting ahead of the potentially damaging threats designed to bypass standard endpoint security
--Why an approach that includes proactive threat hunting, sometimes called Managed Detection and Response, is key to increasing protection against new and advanced threats
--How CrowdStrike Falcon OverWatch can provide 24/7 managed threat hunting, augmenting your security efforts with a team of cyber intrusion detection analysts and investigators who proactively identify and prioritize incidents before they become damaging breaches
PCI DSS Implementation: A Five Step Guide
Payment Card Industry Data Security Standard (PCI DSS) compliance can be both hard and expensive. For most small to medium sized organizations, it doesn’t have to be as long you have the right plan and tools in place. In this guide you’ll learn five steps that you can take to implement and maintain PCI DSS compliance at your organization.
AlienVault PCI DSS Compliance:
https://www.alienvault.com/solutions/pci-dss-compliance
Have a question? Ask it in our forum:
http://forums.alienvault.com
More videos: http://www.youtube.com/user/alienvaulttv
AlienVault Blogs: http://www.alienvault.com/blogs
AlienVault: http://www.alienvault.com
Windows logging cheat sheet
The Windows Logging Cheat Sheet is the definitive guide on learning where to start with Windows Logging. How to Enable, Configure, Gather and Harvest events so you can catch a hacker in the act.
RSA 2016 Security Analytics Presentation
This presentation discusses security analytics, including defining the concept, choosing a path to success, tooling options, and best practices. Security analytics involves analyzing data using advanced methods to achieve useful security outcomes, such as detecting threats better or prioritizing alerts. Success requires an analytic mindset and willingness to explore data. Options for tooling include buying pre-built solutions, building custom capabilities, or partnering with outside experts. The presenter provides examples of user behavior analytics and network traffic analysis tools.
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
Learn about Sogeti’s journey of creating a new Security Operation Center, and how and why we leveraged QRadar solutions. We explore the full program lifecycle, from strategic choices to technical analysis and benchmarking on the product. We explain how QRadar accelerates the go-to-market of the SOC, and how we embed IBM Security Intelligence offerings in our solution. Having a strong collaboration between different IBM stakeholders such as Software Group, Global Technology Services, as well as the Labs, was key to client satisfaction and operational effectiveness. We also show the value of integrating new QRadar features in our SOC roadmap, in order to constantly stay ahead in the cyber security game.
PCI DSS
This document provides an introduction to PCI-DSS (Payment Card Industry Data Security Standard). It defines key terms like PCI, cardholder data, and sensitive authentication data. It explains why PCI security standards are important to protect payment card data and prevent fraud. The document outlines the six goals and twelve requirements of PCI-DSS, as well as introducing PA-DSS which focuses on developing secure payment applications. It provides instructions on determining an organization's PCI compliance level and selecting the appropriate Self Assessment Questionnaire.
Cyber Threat Hunting with Phirelight
"Cyberhunting" actively looks for signs of compromise within an organization and seeks to control and minimize the overall damage. These rare, but essential, breed of enterprise cyber defenders give proactive security a whole new meaning.
Check out the accompanying webinar: http://www.hosting.com/resources/webinars/?commid=228353
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
With cybersecurity threats continuing to grow faster than security budgets, CISOs, CIOs and SecOps teams are left at a dangerous disadvantage.
Even enterprises running their own Security Operations Centers (SOCs) find the perennial shortage of skills, tools, and other resources stops them from realizing the full value of investments. Rather than struggle to find – and hang on to – top talent with hands-on experience across network and cloud security, mid-sized enterprises are instead opting for SOC-as-a-Service offerings.
Soc analyst course content
The SOC analyst training program is meticulously designed by the subject matter experts at Infosec Train. The training program offers a deep insight into the SOC operations and workflows. It is an excellent opportunity for aspiring and current SOC analysts (L1/L2/L3) to level up their skills to mitigate business risks by effectively handling and responding to security threats.
https://www.infosectrain.com/courses/soc-analyst-expert-training/
SOC Architecture Workshop - Part 1
The document discusses advanced security operations centers (A-SOCs) and their capabilities. It describes how A-SOCs go beyond traditional SOCs by focusing on threat mitigation, proactive monitoring and intelligence. It outlines key A-SOC capabilities like threat assessment and hunting, threat intelligence, situational awareness, and security analytics. The document also provides examples of A-SOC architecture, frameworks, technologies, queries, organization structure, and processes. It proposes a maturity model for advanced SOC services and provides an example use case for the Carbanak attack.
SOC 2 Type 2 Checklist - Part 1 - V2.pdf
Looking for answers related to SOC? Here's a 𝐒𝐎𝐂 𝟐 𝐓𝐲𝐩𝐞 𝟐 𝐂𝐡𝐞𝐜𝐤𝐥𝐢𝐬𝐭 to help you keep an eye out for these critical aspects in your #SOC. Don't forget to save this checklist for your SOC compliance journey!
What's hot (20)
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)
Proactive Threat Hunting: Game-Changing Endpoint Protection Beyond Alerting
Proactive Threat Hunting: Game-Changing Endpoint Protection Beyond Alerting
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
Similar to Membangun Security Operation Center
CyberOps Associate Modul 28 Digital Forensics and Incident Analysis and Response
CyberOps Associate Modul 28 Digital Forensics and Incident Analysis and ResponsePanji Ramadhan Hadjarati
CyberOps Associate Modul 28 Digital Forensics and Incident Analysis and ResponsePresentasi Sosialisasi PM SMPI- Bandung 10 Mei 2017
Dokumen tersebut membahas tentang penerapan manajemen keamanan informasi bagi organisasi, meliputi:
1. Penjelasan singkat tentang ISO 27001 dan fokus penerapan sistem keamanan informasi pada staff, proses bisnis, dan teknologi.
2. Tahapan penerapan sistem manajemen keamanan informasi menggunakan pendekatan PDCA (Plan, Do, Check, Act).
SIPI,6,Hajuini,Hapzi Ali, Konsep dasar keamanan sistem informasi,Universitas ...
Penjalasan konsep dasar keamanan sistem informasi dan tipe tipe pengendalian internal serta penerapan di Bank BNI
Keamanan si (ugm)
Rencana kuliah ini membahas tentang keamanan sistem informasi yang mencakup konsep-konsep, jenis ancaman, dan mekanisme pengamanan sistem informasi. Materi kuliah akan dievaluasi melalui tugas dan ujian akhir.
Kelompok 3 (keamanaan sistem terdistribusi)
Kelompok 3:
1. Asmaul Husna Syan (13020170092)
2. A. Firza Tenri Oja (13020170079)
3. Nur Hijriani. Z (13020170097)
5-171004062344.pdf
Dokumen tersebut membahas proses implementasi manajemen keamanan informasi untuk suatu organisasi, meliputi perencanaan dengan menganalisis kesiapan dan manajemen risiko, penyusunan dokumen kebijakan dan pernyataan penerapan, pelaksanaan kontrol keamanan dan mitigasi risiko, serta pemantauan dan evaluasi berkelanjutan melalui audit internal dan tinjauan manajemen.
Materi V Sosialisasi Permen SMPI Serpong 4 Oktober 2017
Dokumen tersebut membahas proses implementasi manajemen keamanan informasi untuk suatu organisasi, meliputi perencanaan dengan menganalisis kesiapan dan manajemen risiko, penyusunan dokumen kebijakan dan pernyataan penerapan, pelaksanaan kontrol keamanan dan mitigasi risiko, serta pemantauan dan evaluasi berkelanjutan melalui audit internal dan tinjauan manajemen.
Pengendalian Sistem Informasi berdasarkan Komputer
Dokumen tersebut membahas empat prinsip keandalan sistem yaitu ketersediaan, keamanan, dapat dipertahankan, dan integritas beserta kriteria evaluasi dan pengendalian yang terkait dengan masing-masing prinsip."
Similar to Membangun Security Operation Center (20)
MAKALAHITFTGS2 1901020056 Merrick Renee Thamrin.pdf
MAKALAHITFTGS2 1901020056 Merrick Renee Thamrin.pdf
CyberOps Associate Modul 28 Digital Forensics and Incident Analysis and Response
CyberOps Associate Modul 28 Digital Forensics and Incident Analysis and Response
Presentasi Sosialisasi PM SMPI- Bandung 10 Mei 2017
Presentasi Sosialisasi PM SMPI- Bandung 10 Mei 2017
SIPI,6,Hajuini,Hapzi Ali, Konsep dasar keamanan sistem informasi,Universitas ...
SIPI,6,Hajuini,Hapzi Ali, Konsep dasar keamanan sistem informasi,Universitas ...
Materi V Sosialisasi Permen SMPI Serpong 4 Oktober 2017
Materi V Sosialisasi Permen SMPI Serpong 4 Oktober 2017
Pengendalian Sistem Informasi berdasarkan Komputer
Pengendalian Sistem Informasi berdasarkan Komputer
Keamanan Dan Pengendalian Komputer_Rani Nurrohmah_STIAMI
Keamanan Dan Pengendalian Komputer_Rani Nurrohmah_STIAMI
Membangun Security Operation Center
- 1. Oleh : M. Shidiq Purnama
- 5. • Analis Level 1 : bertugas untuk operasional pemantauan Log dan korelasi Keahlian : Dasar IT, Network dan Security terutama dalam membaca log • Analis Level 2 : Bertugas untuk menangani serangan serta memastikan apakah sudah menjadi insiden Keahlian : Level 1 + analisa serangan dan forensik dasar • Analis Level 3 : Bertugas melakukan investigasi. Forensik sampai penanganan insiden Keahlian : Memahami forensik tingkat lanjut
- 6. • Kebijakan : Menguraikan peran dan tanggung jawab, mendefinisikan ruang lingkup informasi yang akan dilindungi, dan memberikan gambaran tingkat tinggi dari kontrol untuk melindungi informasi • Standart : Standar terdiri daripengendalian khusus tingkat rendah wajib yang membantu menegakkan dan mendukung kebijakan keamanan informasi. • Pedoman : Pedoman terdiri dari yang direkomendasikan, non-wajib control yang membantu mendukung standar atau melayani sebagai referensi apabila standar yang berlaku adalah ditempat. • Prosedur : Prosedur terdiri dari langkah demi langkah petunjuk untuk membantu pekerja dalammelaksanakan berbagai kebijakan, standar dan pedoman. ISO 20000 (IT Service Management)
- 7. • Sensor : Untuk mengumpulkan event atau data • Log Management : Untuk mengumpulkan, normalisasi dan menyimpan log • Correlation Enggine : Untuk menganalisa Log dan Event • Response System : Untuk bereaksi terhadap serangan dan kemungkinan insiden
- 10. Strategi Pembangunan SOC • In-house : Perangkat, Sumber Daya Manusia dan Proses (Kebijakan, Standar dan Prosedur) dikelola oleh internal • Managed Services (Outsourced) : Layanan dilakukan oleh Pihak ke-3 yang berkompeten di bidang SOC
- 11. Project
- 12. Shortener s.id
- 15. My.ID (tidak dikembangkan lagi)
- 16. DNS Big Data Analytics