this presentation about SIEM and SOC Mudules

1. Security Operation Center
(SOC)
By Abolfazl Naderi
Naderi.training@gmail.com
‫خدا‬ ‫نام‬ ‫به‬

2. Cyber Attack Charts

3. Cyber Attack Charts

4. A kill chain is a term used by the
US military to describe the steps
or stages an adversary takes to
attack you.
Cyber Kill Chain

5. A set of tools, people and processes to Identify, analyze, respond to events and
prevent cyber security incidents.
What is SOC?

6. NOC
Network Fault Tolerance
Switch/Router
Configuration
Sniffing and
Troubleshooting
System and Traffic Monitor
SOC
Network Behavior anomaly
detection
Intrusion Detection
Log Management
Network Forensics
Vulnerability detection and
Awareness
Management and Change
Policy
All NOC Feature
NOC vs. SOC

7. Secure SOC

8.  Effective Management of Events
 Centralized Security Monitoring and Real-time Network Traffic
 Effective Patch and Update Management
 Calculate and Analyze Network Risk
Importance and necessity of SOC

9. Effective Management of Events

10. ‫ش‬ ‫ترافیک‬ ‫آنی‬ ‫و‬ ‫متمرکز‬ ‫امنیتی‬ ‫رصد‬‫بکه‬
Centralized Security Monitoring and Real-time Network Traffic

11. ‫امنیتی‬ ‫های‬ ‫وصله‬ ‫موثر‬ ‫مدیریت‬
Patch and Update Management

12. ‫شبکه‬ ‫ریسک‬ ‫تحلیل‬
Calculate and Analyze Network Risk

13. Goals implement SOC
Appropriate and effective dealing with security
events and threats
Promote security and stability of data and services
by protecting information infrastructure, traffic,
services and customer data
Reduce the time of disruption to customer service
Improve and speed up the security responses
Improve network performance
Reduce the costs of security threats and attacks

14. Key Factors of SOC

15. ‫نیاز‬ ‫مورد‬ ‫های‬ ‫آموزش‬ ‫وظایف‬ ‫عنوان‬‫شغلی‬
•‫فرآیند‬‫بندی‬ ‫الویت‬‫هشدارها؛‬
•‫شبکه‬ ‫نفوذ‬ ‫تشخیص‬.
•‫کار‬‫با‬‫اطالعا‬ ‫مدیریت‬ ‫سیستم‬‫و‬ ‫ت‬
‫یا‬ ‫امنیتی‬ ‫رخدادهای‬SIEM‫و‬
‫خاص‬ ‫ابزار‬ ‫آموزش‬ ‫دیگر‬.
•‫های‬ ‫گواهینامه‬‫آموزش‬ ‫به‬ ‫مربوط‬
‫مان‬ ‫امنیتی‬ ‫ای‬ ‫پایه‬ ‫و‬ ‫اولیه‬ ‫های‬‫ند‬
Security +،SANS 401‫و‬
...
•‫مانیتورینگ‬‫هشدار‬ ‫صف‬ ‫مداوم‬‫ها‬
•‫بندی‬ ‫الویت‬‫امنیتی‬ ‫هشدارهای‬
•‫عملکرد‬ ‫صحت‬ ‫بر‬ ‫نظارت‬
‫نقطه‬ ‫و‬ ‫امنیتی‬ ‫سنسورهای‬
‫پایانی‬
•‫اطالعات‬ ‫آوری‬ ‫جمع‬‫ایجاد‬ ‫و‬
‫کار‬ ‫شروع‬ ‫برای‬ ‫الزم‬ ‫زمینه‬Tier
2.
Tier 1
Alert Analyst
People

16. ‫نیاز‬ ‫مورد‬ ‫های‬ ‫آموزش‬ ‫وظایف‬ ‫عنوان‬‫شغلی‬
•Forensic‫پیشرفت‬ ‫های‬ ‫شبکه‬،‫ه‬
Forensic،‫میزبان‬
•‫به‬ ‫پاسخ‬ ‫پیشرفته‬ ‫روشهای‬
‫حوادث‬
•‫ها‬ ‫الگ‬ ‫بازخوانی‬
•‫بدافزارها‬ ‫اولیه‬ ‫ارزیابی‬
•Forensic‫تهدیدات‬ ‫شبکه‬
•‫حوزه‬ ‫در‬ ‫امنیتی‬ ‫مدارک‬ ‫دارای‬
‫نفوذ‬ ‫تست‬‫و‬Forensic‫مانند‬
CEH،ECSA،CHFI،GCFA
‫و‬...
•‫ب‬ ‫حادثه‬ ‫تحلیل‬ ‫و‬ ‫تجزیه‬ ‫انجام‬‫ا‬
‫سنجی‬ ‫ازهمبستگی‬ ‫استفاده‬
‫اطالعات‬ ‫میان‬‫مختلف‬ ‫منابع‬.
•‫در‬ ‫بحرانی‬ ‫وضعیت‬ ‫تعیین‬
‫داده‬ ‫مجموعه‬ ‫یا‬ ‫سیستم‬.
•‫بازسازی‬ ‫در‬ ‫مشاوره‬.
•‫پشتیبانی‬ ‫امکان‬ ‫کردن‬ ‫فراهم‬‫از‬
‫برای‬ ‫جدید‬ ‫تحلیلی‬ ‫های‬ ‫روش‬
‫تهدیدات‬ ‫شناسایی‬
Tier 2
Incident
Responder
People

17. ‫نیاز‬ ‫مورد‬ ‫های‬ ‫آموزش‬ ‫وظایف‬ ‫عنوان‬‫شغلی‬
•‫تشخیص‬ ‫در‬ ‫پیشرفته‬ ‫های‬ ‫آموزش‬
‫ناهنجاری‬
•‫آوری‬ ‫جمع‬ ‫برای‬ ‫آموزش‬ ‫خاص‬ ‫ابزار‬
‫هوش‬ ‫و‬ ‫تحلیل‬ ‫و‬ ‫تجزیه‬ ‫و‬ ‫ها‬ ‫داده‬
‫تهدید‬
‫امنیتی‬ ‫مدارک‬ ‫دارای‬SANS‫مانند‬
SEC503: Intrusion Detection
In-Depth
SANS SEC504: Hacker
Tools, Techniques, Exploits and
Incident Handling;
SANS SEC561: Intense Hands-on
Pen Testing
Skill Development;
SANS FOR610: Reverse-
Engineering Malware:
•‫نقطه‬ ،‫شبکه‬ ‫در‬ ‫عمیق‬ ‫دانش‬ ‫دارای‬
،‫تهدیدات‬ ‫اطالعات‬ ،‫پایانی‬
Forensic‫معکوس‬ ‫مهندسی‬ ‫و‬
‫بدافزارها‬‫و‬‫برنامه‬ ‫عملکرد‬ ‫همچنین‬
‫زیرساخت‬ ‫یا‬ ‫و‬ ‫خاص‬ ‫کاربردی‬ ‫های‬
‫اساسی‬ ‫های‬IT
•‫در‬‫مانند‬ ‫حوادث‬ ‫مقابل‬"‫شکارچ‬‫ی‬”
‫از‬ ‫قبل‬ ‫را‬ ‫وحوادث‬ ‫کرده‬ ‫عمل‬
‫تشدیدشدن‬‫سازد‬ ‫می‬ ‫برطرف‬
•‫اجرا‬ ‫و‬ ‫تنظیم‬ ،‫توسعه‬ ‫در‬ ‫نزدیک‬ ‫از‬‫ی‬
‫تهدید‬ ‫تشخیص‬ ‫تحلیل‬ ‫و‬ ‫تجزیه‬‫ات‬
‫باشند‬ ‫دخیل‬.
Tier 3
Subject Matter
Expert/ Hunter
People

18. ‫نیاز‬ ‫مورد‬ ‫های‬ ‫آموزش‬ ‫وظایف‬ ‫عنوان‬‫شغلی‬
•‫پروژه‬ ‫مدیریت‬
•‫حوادث‬ ‫به‬ ‫گویی‬ ‫پاسخ‬ ‫مدیریت‬
•‫قابلیت‬‫کلی‬ ‫مدیریت‬‫افراد‬
•‫شامل‬ ‫ها‬ ‫گواهینامه‬CISSP،
CISA،CISM‫مقابل‬CGEIT.
•‫بود‬ ،‫پرسنل‬ ‫شامل‬ ‫منابع‬ ‫مدیریت‬،‫جه‬
‫استراتژی‬ ‫و‬ ‫تغییر‬ ‫ریزی‬ ‫برنامه‬
‫رفع‬ ‫برای‬ ‫تکنولوژی‬SLA‫ها‬
•‫مدیریت‬ ‫با‬ ‫ارتباط‬.
•‫برای‬ ‫سازمانی‬ ‫مسئول‬ ‫عنوان‬ ‫به‬
‫کسب‬ ‫در‬ ‫بحرانی‬ ‫حوادث‬ ‫با‬ ‫مقابله‬‫و‬
‫سازمان‬ ‫کار‬.
•‫کلی‬ ‫رهبری‬SOC‫سازی‬ ‫فراهم‬ ‫و‬
‫امنیت‬ ‫کلی‬ ‫استراتژی‬
SOC Manager
People

19. Organization Chart of SOC

20. 1
• Create a process for repeating events
2
• Workflow created to deal with threats
3
• Implementation of incident response
processes
Process

21. Technology

22. Sensors and Feeder
Security Information Event Management
Patch Management System
Ticketing System
Vulnerability Assessment
Traffic Flow Analyzer
Major Components of the SOC

23. Security Software
Operating System
Application
Sensors and Feeder

24. ‫امنیتی‬ ‫افزارهای‬ ‫سخت‬ ‫و‬ ‫افزارها‬ ‫نرم‬
 UTM/Firewall
 Anti Malware
 IPS/IDS
 Remote Access Software
 Web proxy
 Vulnerability Management System
 Authentication Servers
 Network Quarantine Servers
 Router and Switch
Security Software

25.  System Events
 Service Changes
 System Operation like Restart, shutdown
 Audit Records
 Security Events Like Successful or Failed Login
 Access to Files
 Change Security Policy
 User Changes
Operating System

26.  Client Requests and Server Responses
 Web Server , Mail Server , …
 Account Information
 Authentication Logs , User Modification , Permission Modification
 Brute Force , Guessing , Privilege Escalation , …
 Usage Information
 Number of Transaction , Traffic Bandwidth , Number of Mail , …
 Significant Operational Actions
 Software Problems , Service Shut or Up , …
Applications

27.  Nessus
 Acunetix
 GFI LANGuard
 IBM AppScan
 Netsparker
 Burp Suite
 Retina
 Qualys
 HP WebInspect
Vulnerability Scanner

28. Collection
Store
Analyze
Disposal
SIEM

29. Aggregation
Filtering
Normalize
Collection

30. Log
Rotation
Log
Archival
Log
Compression
Log
Reduction
Log
Conversion
Hash
Chain
Store

31. Event
Correlation
Visualization
Log Viewing
Log
Reporting
Dashboards
Analyze

32. Reduce
Noise
Log
Retention
Disposal

33.  Compare events from multiple sources to track
users and processes across systems.
 Track events across time periods to look for
sequences of activity that should not normally
occur
 Encode human knowledge about what it not normal
for a system, or indicates a probably attack, into
automatic monitoring
 Log Correlation is the most powerful feature in SIEM
Correlation

34. Correlation

35. • Rule-Base Correlation
• Vulnerability Correlation
• Statistical Correlation
• Anomaly Detection
• Identity Correlation
• …
Correlation Type
Type of Correlation

36.  www.sans.org
 Building a World-Class Security Operations Center:
A Roadmap – SANS
 www.behinrahkar.com
References