Security Ops for large and small companies
•
2 likes•342 views
This document provides an overview of security operations (SOC) for companies of all sizes. It discusses the basic questions companies should ask regarding their security needs, how to approach monitoring both business and system metrics, and an in-depth look at monitoring and establishing an internal SOC. It then discusses solutions for security operations, both free and enterprise options, and things to consider if solutions are not working as expected or fail. The document concludes with embedding security into IT operations, discussing overlapping processes, compliance standards, typical incident response plans, and automating security processes. It also covers different approaches to security testing programs.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Security Ops for large and small companies
Similar to Security Ops for large and small companies (20)
Recently uploaded
Recently uploaded (20)
Security Ops for large and small companies
- 1. Security OPS for large and small companies #PAYMENTSECURITY, Saint-Petersburg, Russia, 2017
- 2. #whoami Mona Arkhipova ◎ Unit Manager of information security architecture and monitoring at software vendor and cloud services ◎ Co-owner at internet acquiring software custom development company ◎ Independent security consultant Past • Head of SOC and OPS monitoring, Lead information security expert at QIWI group; • Security analyst at General Electric (GE Capital); • Independent security consultant at fintech start-ups; • *nix systems and network administrator
- 3. 1. First steps to secure your operations Do you really need ISOC?
- 4. (Not so) Basic questions Interests Business owners Patent owners Customers, clients, partners Employees Law Society … Objects Source code Data Services Systems Reputation … Threats Hackers Insiders Regulation authorities Disasters Competitors and partners …
- 6. Monitoring/ISOC: in depth Behavior analysis Data flows Services policies OS/device policies Log source typization Inventory & Discovery
- 8. ”Working not as expected” ◎Gather references, mostly from hands-on specialists ◎Try to pilot on large amount of various data ◎Performance testing under overload ◎There’s no silver bullet
- 9. What’s about free solutions? Small/Mid ◎Good point to start ◎…if your production would stay the same size ◎May be supported by IT ◎(most) processes may be easily changed Mid/Large ◎Also good point to start ◎…if you don’t have compliance requirements on retention ◎And if you have enough resources for internal development ◎Calculate solution cost on different lifecycle stages
- 10. Enterprise solutions ◎Support response speed ◎Patching speed ◎Amount of experts on solution ◎Professional services costs Does the solution needed/may be applied only for security?
- 11. If solution fails ◎Look for enhancements ◎Recheck the covered scopes ◎Solution criticality ◎Calculate TCO ◎Plan changes
- 12. 3. Embedding security into IT operations Mission possible
- 13. Overlapping processes ◎Inventory ◎Sources setup ◎Hardening processes support ◎Access management ◎In-depth knowledge of services/networks ◎Awareness ◎Win-win deployments (share your tools!)
- 14. CIS CSC 20 ◎Easy to explain ◎Easy to convert to roadmaps
- 15. Typical incidents ◎Prepare detailed response plans ◎Create kb on known issues ◎Alerts may be pushed outside ◎May be partially handled by duty/IT monitoring team ◎Keep it simple
- 16. Automate all the things ◎Access workflows ◎CMDB/simple inventory ◎Hardening controls/self-healing ◎Patch management ◎Agents review
- 17. I’m loving IT Team up Security and IT and you might like the result
- 19. Common way ◎Limited scope and vectors ◎Single team/vendor ◎Well-known scenarios ◎Approved testing windows ◎Whitelisting as a requirement
- 20. Common way cons ◎Lack of coverage ◎Toolbox ◎Too much approvals ◎“This is for compliance only”
- 21. Red team vs Blue team ◎Good for large systems ◎Full coverage of internals ◎Scope is related to all security and awareness processes (not only IT systems) ◎Greatest way to test your team and tools ◎Safe way to get a ’real’ incident and apply appropriate mitigations
- 22. Red team cons ◎Price ◎DoS and urgent changes ◎Urgent reinstall ◎All employees are the target too ◎IT security team overload ◎24x7 attacks
- 23. Thanks! Any questions? You can find me at: /monaarkhipova mona@sudo.su