SIEM and SOC

Security Operation Center
(SOC)
By Abolfazl Naderi
Naderi.training@gmail.com
‫خدا‬ ‫نام‬ ‫به‬

A kill chain is a term used by the
US military to describe the steps
or stages an adversary takes to
attack you.
Cyber Kill Chain

A set of tools, people and processes to Identify, analyze, respond to events and
prevent cyber security incidents.
What is SOC?

NOC
Network Fault Tolerance
Switch/Router
Configuration
Sniffing and
Troubleshooting
System and Traffic Monitor
SOC
Network Behavior anomaly
detection
Intrusion Detection
Log Management
Network Forensics
Vulnerability detection and
Awareness
Management and Change
Policy
All NOC Feature
NOC vs. SOC

 Effective Management of Events
 Centralized Security Monitoring and Real-time Network Traffic
 Effective Patch and Update Management
 Calculate and Analyze Network Risk
Importance and necessity of SOC

Effective Management of Events

‫ش‬ ‫ترافیک‬ ‫آنی‬ ‫و‬ ‫متمرکز‬ ‫امنیتی‬ ‫رصد‬‫بکه‬
Centralized Security Monitoring and Real-time Network Traffic

‫امنیتی‬ ‫های‬ ‫وصله‬ ‫موثر‬ ‫مدیریت‬
Patch and Update Management

‫شبکه‬ ‫ریسک‬ ‫تحلیل‬
Calculate and Analyze Network Risk

Goals implement SOC
Appropriate and effective dealing with security
events and threats
Promote security and stability of data and services
by protecting information infrastructure, traffic,
services and customer data
Reduce the time of disruption to customer service
Improve and speed up the security responses
Improve network performance
Reduce the costs of security threats and attacks

‫نیاز‬ ‫مورد‬ ‫های‬ ‫آموزش‬ ‫وظایف‬ ‫عنوان‬‫شغلی‬
•‫فرآیند‬‫بندی‬ ‫الویت‬‫هشدارها؛‬
•‫شبکه‬ ‫نفوذ‬ ‫تشخیص‬.
•‫کار‬‫با‬‫اطالعا‬ ‫مدیریت‬ ‫سیستم‬‫و‬ ‫ت‬
‫یا‬ ‫امنیتی‬ ‫رخدادهای‬SIEM‫و‬
‫خاص‬ ‫ابزار‬ ‫آموزش‬ ‫دیگر‬.
•‫های‬ ‫گواهینامه‬‫آموزش‬ ‫به‬ ‫مربوط‬
‫مان‬ ‫امنیتی‬ ‫ای‬ ‫پایه‬ ‫و‬ ‫اولیه‬ ‫های‬‫ند‬
Security +،SANS 401‫و‬
...
•‫مانیتورینگ‬‫هشدار‬ ‫صف‬ ‫مداوم‬‫ها‬
•‫بندی‬ ‫الویت‬‫امنیتی‬ ‫هشدارهای‬
•‫عملکرد‬ ‫صحت‬ ‫بر‬ ‫نظارت‬
‫نقطه‬ ‫و‬ ‫امنیتی‬ ‫سنسورهای‬
‫پایانی‬
•‫اطالعات‬ ‫آوری‬ ‫جمع‬‫ایجاد‬ ‫و‬
‫کار‬ ‫شروع‬ ‫برای‬ ‫الزم‬ ‫زمینه‬Tier
2.
Tier 1
Alert Analyst
People

•Forensic‫پیشرفت‬ ‫های‬ ‫شبکه‬،‫ه‬
Forensic،‫میزبان‬
•‫به‬ ‫پاسخ‬ ‫پیشرفته‬ ‫روشهای‬
‫حوادث‬
•‫ها‬ ‫الگ‬ ‫بازخوانی‬
•‫بدافزارها‬ ‫اولیه‬ ‫ارزیابی‬
•Forensic‫تهدیدات‬ ‫شبکه‬
•‫حوزه‬ ‫در‬ ‫امنیتی‬ ‫مدارک‬ ‫دارای‬
‫نفوذ‬ ‫تست‬‫و‬Forensic‫مانند‬
CEH،ECSA،CHFI،GCFA
‫و‬...
•‫ب‬ ‫حادثه‬ ‫تحلیل‬ ‫و‬ ‫تجزیه‬ ‫انجام‬‫ا‬
‫سنجی‬ ‫ازهمبستگی‬ ‫استفاده‬
‫اطالعات‬ ‫میان‬‫مختلف‬ ‫منابع‬.
•‫در‬ ‫بحرانی‬ ‫وضعیت‬ ‫تعیین‬
‫داده‬ ‫مجموعه‬ ‫یا‬ ‫سیستم‬.
•‫بازسازی‬ ‫در‬ ‫مشاوره‬.
•‫پشتیبانی‬ ‫امکان‬ ‫کردن‬ ‫فراهم‬‫از‬
‫برای‬ ‫جدید‬ ‫تحلیلی‬ ‫های‬ ‫روش‬
‫تهدیدات‬ ‫شناسایی‬
Tier 2
Incident
Responder
People

•‫تشخیص‬ ‫در‬ ‫پیشرفته‬ ‫های‬ ‫آموزش‬
‫ناهنجاری‬
•‫آوری‬ ‫جمع‬ ‫برای‬ ‫آموزش‬ ‫خاص‬ ‫ابزار‬
‫هوش‬ ‫و‬ ‫تحلیل‬ ‫و‬ ‫تجزیه‬ ‫و‬ ‫ها‬ ‫داده‬
‫تهدید‬
‫امنیتی‬ ‫مدارک‬ ‫دارای‬SANS‫مانند‬
SEC503: Intrusion Detection
In-Depth
SANS SEC504: Hacker
Tools, Techniques, Exploits and
Incident Handling;
SANS SEC561: Intense Hands-on
Pen Testing
Skill Development;
SANS FOR610: Reverse-
Engineering Malware:
•‫نقطه‬ ،‫شبکه‬ ‫در‬ ‫عمیق‬ ‫دانش‬ ‫دارای‬
،‫تهدیدات‬ ‫اطالعات‬ ،‫پایانی‬
Forensic‫معکوس‬ ‫مهندسی‬ ‫و‬
‫بدافزارها‬‫و‬‫برنامه‬ ‫عملکرد‬ ‫همچنین‬
‫زیرساخت‬ ‫یا‬ ‫و‬ ‫خاص‬ ‫کاربردی‬ ‫های‬
‫اساسی‬ ‫های‬IT
•‫در‬‫مانند‬ ‫حوادث‬ ‫مقابل‬"‫شکارچ‬‫ی‬”
‫از‬ ‫قبل‬ ‫را‬ ‫وحوادث‬ ‫کرده‬ ‫عمل‬
‫تشدیدشدن‬‫سازد‬ ‫می‬ ‫برطرف‬
•‫اجرا‬ ‫و‬ ‫تنظیم‬ ،‫توسعه‬ ‫در‬ ‫نزدیک‬ ‫از‬‫ی‬
‫تهدید‬ ‫تشخیص‬ ‫تحلیل‬ ‫و‬ ‫تجزیه‬‫ات‬
‫باشند‬ ‫دخیل‬.
Tier 3
Subject Matter
Expert/ Hunter
People

•‫پروژه‬ ‫مدیریت‬
•‫حوادث‬ ‫به‬ ‫گویی‬ ‫پاسخ‬ ‫مدیریت‬
•‫قابلیت‬‫کلی‬ ‫مدیریت‬‫افراد‬
•‫شامل‬ ‫ها‬ ‫گواهینامه‬CISSP،
CISA،CISM‫مقابل‬CGEIT.
•‫بود‬ ،‫پرسنل‬ ‫شامل‬ ‫منابع‬ ‫مدیریت‬،‫جه‬
‫استراتژی‬ ‫و‬ ‫تغییر‬ ‫ریزی‬ ‫برنامه‬
‫رفع‬ ‫برای‬ ‫تکنولوژی‬SLA‫ها‬
•‫مدیریت‬ ‫با‬ ‫ارتباط‬.
•‫برای‬ ‫سازمانی‬ ‫مسئول‬ ‫عنوان‬ ‫به‬
‫کسب‬ ‫در‬ ‫بحرانی‬ ‫حوادث‬ ‫با‬ ‫مقابله‬‫و‬
‫سازمان‬ ‫کار‬.
•‫کلی‬ ‫رهبری‬SOC‫سازی‬ ‫فراهم‬ ‫و‬
‫امنیت‬ ‫کلی‬ ‫استراتژی‬
SOC Manager
People

1
• Create a process for repeating events
2
• Workflow created to deal with threats
3
• Implementation of incident response
processes
Process

Sensors and Feeder
Security Information Event Management
Patch Management System
Ticketing System
Vulnerability Assessment
Traffic Flow Analyzer
Major Components of the SOC

Security Software
Operating System
Application
Sensors and Feeder

‫امنیتی‬ ‫افزارهای‬ ‫سخت‬ ‫و‬ ‫افزارها‬ ‫نرم‬
 UTM/Firewall
 Anti Malware
 IPS/IDS
 Remote Access Software
 Web proxy
 Vulnerability Management System
 Authentication Servers
 Network Quarantine Servers
 Router and Switch
Security Software

 System Events
 Service Changes
 System Operation like Restart, shutdown
 Audit Records
 Security Events Like Successful or Failed Login
 Access to Files
 Change Security Policy
 User Changes
Operating System

 Client Requests and Server Responses
 Web Server , Mail Server , …
 Account Information
 Authentication Logs , User Modification , Permission Modification
 Brute Force , Guessing , Privilege Escalation , …
 Usage Information
 Number of Transaction , Traffic Bandwidth , Number of Mail , …
 Significant Operational Actions
 Software Problems , Service Shut or Up , …
Applications

 Nessus
 Acunetix
 GFI LANGuard
 IBM AppScan
 Netsparker
 Burp Suite
 Retina
 Qualys
 HP WebInspect
Vulnerability Scanner

Collection
Store
Analyze
Disposal
SIEM

Aggregation
Filtering
Normalize
Collection

Log
Rotation
Log
Archival
Log
Compression
Log
Reduction
Log
Conversion
Hash
Chain
Store

Event
Correlation
Visualization
Log Viewing
Log
Reporting
Dashboards
Analyze

Reduce
Noise
Log
Retention
Disposal

 Compare events from multiple sources to track
users and processes across systems.
 Track events across time periods to look for
sequences of activity that should not normally
occur
 Encode human knowledge about what it not normal
for a system, or indicates a probably attack, into
automatic monitoring
 Log Correlation is the most powerful feature in SIEM
Correlation

• Rule-Base Correlation
• Vulnerability Correlation
• Statistical Correlation
• Anomaly Detection
• Identity Correlation
• …
Correlation Type
Type of Correlation

 www.sans.org
 Building a World-Class Security Operations Center:
A Roadmap – SANS
 www.behinrahkar.com
References

SIEM and SOC

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to SIEM and SOC (20)

SIEM and SOC