Uploaded byMona Arkhipova
Security Ops for large and small companies
This document provides an overview of security operations (SOC) for companies of all sizes. It discusses the basic questions companies should ask regarding their security needs, how to approach monitoring both business and system metrics, and an in-depth look at monitoring and establishing an internal SOC. It then discusses solutions for security operations, both free and enterprise options, and things to consider if solutions are not working as expected or fail. The document concludes with embedding security into IT operations, discussing overlapping processes, compliance standards, typical incident response plans, and automating security processes. It also covers different approaches to security testing programs.
More Related Content
Similar to Security Ops for large and small companies
Security Ops for large and small companies
- 1. Security OPS for largeand small companies #PAYMENTSECURITY, Saint-Petersburg, Russia, 2017
- 2. #whoami Mona Arkhipova ◎ UnitManager of information security architecture and monitoring at software vendor and cloud services ◎ Co-owner at internet acquiring software custom development company ◎ Independent security consultant Past • Head of SOC and OPS monitoring, Lead information security expert at QIWI group; • Security analyst at General Electric (GE Capital); • Independent security consultant at fintech start-ups; • *nix systems and network administrator
- 3. 1. First steps tosecure your operations Do you really need ISOC?
- 4. (Not so) Basicquestions Interests Business owners Patent owners Customers, clients, partners Employees Law Society … Objects Source code Data Services Systems Reputation … Threats Hackers Insiders Regulation authorities Disasters Competitors and partners …
- 5.
- 6. Monitoring/ISOC: in depth Behavioranalysis Data flows Services policies OS/device policies Log source typization Inventory & Discovery
- 7.
- 8. ”Working not asexpected” ◎Gather references, mostly from hands-on specialists ◎Try to pilot on large amount of various data ◎Performance testing under overload ◎There’s no silver bullet
- 9. What’s about freesolutions? Small/Mid ◎Good point to start ◎…if your production would stay the same size ◎May be supported by IT ◎(most) processes may be easily changed Mid/Large ◎Also good point to start ◎…if you don’t have compliance requirements on retention ◎And if you have enough resources for internal development ◎Calculate solution cost on different lifecycle stages
- 10. Enterprise solutions ◎Support responsespeed ◎Patching speed ◎Amount of experts on solution ◎Professional services costs Does the solution needed/may be applied only for security?
- 11. If solution fails ◎Lookfor enhancements ◎Recheck the covered scopes ◎Solution criticality ◎Calculate TCO ◎Plan changes
- 12. 3. Embedding security into IToperations Mission possible
- 13. Overlapping processes ◎Inventory ◎Sources setup ◎Hardeningprocesses support ◎Access management ◎In-depth knowledge of services/networks ◎Awareness ◎Win-win deployments (share your tools!)
- 14. CIS CSC 20 ◎Easyto explain ◎Easy to convert to roadmaps
- 15. Typical incidents ◎Prepare detailedresponse plans ◎Create kb on known issues ◎Alerts may be pushed outside ◎May be partially handled by duty/IT monitoring team ◎Keep it simple
- 16. Automate all thethings ◎Access workflows ◎CMDB/simple inventory ◎Hardening controls/self-healing ◎Patch management ◎Agents review
- 17. I’m loving IT Team upSecurity and IT and you might like the result
- 18.
- 19. Common way ◎Limited scopeand vectors ◎Single team/vendor ◎Well-known scenarios ◎Approved testing windows ◎Whitelisting as a requirement
- 20. Common way cons ◎Lackof coverage ◎Toolbox ◎Too much approvals ◎“This is for compliance only”
- 21. Red team vsBlue team ◎Good for large systems ◎Full coverage of internals ◎Scope is related to all security and awareness processes (not only IT systems) ◎Greatest way to test your team and tools ◎Safe way to get a ’real’ incident and apply appropriate mitigations
- 22. Red team cons ◎Price ◎DoSand urgent changes ◎Urgent reinstall ◎All employees are the target too ◎IT security team overload ◎24x7 attacks
- 23. Thanks! Any questions? You canfind me at: /monaarkhipova mona@sudo.su