Download as PDF, PPTX
Uploaded byShomiron Das Gupta
SACON16 - SOC Architecture
This document discusses building a next-generation security operations center (SOC) to better detect advanced persistent threats (APTs). It recommends taking a process-oriented approach to detection by visualizing engagement with threats, identifying detection phases, and connecting use cases for multi-phase threats. An advanced SOC (ASOC) model is presented that separates hunters to actively look for threats from SOC operations teams to react, respond, and resolve incidents, with metrics and continuous improvement. The document encourages building a threat mind map and playbook of use cases tailored to an organization's highest probability threats to anticipate attacks. It emphasizes focusing on indicators of compromise or attempt to compromise over individual events and iterating the SOC process weekly.
More Related Content
Similar to SACON16 - SOC Architecture
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
SACON16 - SOC Architecture
- 1. #SACON Building the NextGenSOC Shomiron DAS GUPTA (GCIA) Founder, CEO NETMONASTERY Inc.
- 2. #SACON Agenda ■ Why areAPTs difficult to detect ■ Revisit the cyber kill chain ■ Process orient detection ■ NextGen SOC process ■ Building your threat mind map ■ Implement and measure your SOC
- 3. #SACON Why are wefailing to pick them ■ Made to order ■ Exploit trust relationships ■ Multi stage deployments
- 4. #SACON The Cyber KillChain ■ Reconnaissance ■ Weaponize ■ Delivery ■ Exploitation ■ Installation ■ Command and Control ■ Actions on objectives
- 5. So which arethe phases you should track to detect Advanced Persistent Threats?
- 6. #SACON The Cyber KillChain ■ Reconnaissance ■ Weaponize ■ Delivery ■ Exploitation ■ Installation ■ Command and Control ■ Actions on objectives
- 7. So, what areyou looking for? Indicators Of Compromise or Attempt To Compromise
- 8.
- 9. #SACON Process Orient Detection ■Visualize your engagement with threats ■ Identify detection phases ■ Build a list of primary issues ■ Create use cases ■ Connect use cases for multi phase threats ■ Burn the context layer in to your SIEM for detection
- 10. #SACON Concerns from theOld SOC ■ Lack of focus on detection ■ Push required to build new rules ■ Rules get out dated before you go production ■ Continuous improvement doesn’t exist ■ Lack of active pursuit
- 11. #SACON ASOC One suchoption Hunter • Looking for threats • Multiple toolkits • No boundaries - laterals • Finding loopholes • Building content • Writing process • Handover and review Process SOC Ops • Understand threats • React - FP Filtering • Respond • Resolve • Metrics & Improvement • Case retirement
- 12.
- 13. #SACON Building your ThreatMind Map
- 14. #SACON What does ittake? ■ Approach IOC or ATC ■ Anticipation High Probability Threats ■ Active Playbook Build - Review - Improve
- 15.
- 16.
- 17.
- 18.
- 19.
- 20. #SACON Alerts v/s Incidents ■Alerts are instant and descriptive ■ Incidents are usually delayed and vague ■ Alerts can be remediated ■ Incidents need handling What would you work towards - Alerts or Incidents
- 21. #SACON Watching the AfterLife ■Sold in the underground unless a sponsored activity ■ Stolen data is segregated ■ Sometimes published ■ Mostly used quickly for monetary gain How would you track your data in the AfterLife?
- 22. #SACON Implement and Measure ■Watch for primary issues not events ■ Connect multi phase threats automatically with tools ■ Selectively implement incident management ■ Look out for threat trends ■ Cyclically iterate and improve every week #SACON
- 23. Shomiron DAS GUPTA shomiron@netmonastery.com +919820336050 Thank You!