WEBVTT

0:00:09.840000 --> 0:00:14.840000
 Hello everyone and welcome to the introduction
 to Security Operations

0:00:14.840000 --> 0:00:18.100000
 Center course here at INE.

0:00:18.100000 --> 0:00:22.640000
 My name is Alexis Ahmed and I'm going
 to be your instructor for this course.

0:00:22.640000 --> 0:00:27.120000
 Now before we get started with this
 course, I always like providing an

0:00:27.120000 --> 0:00:30.740000
 overview of the course so you have an
 understanding as to what to expect

0:00:30.740000 --> 0:00:34.420000
 and what we're going to cover in this
 course and more importantly what

0:00:34.420000 --> 0:00:39.540000
 the learning outcomes or the objectives
 are of this course or for this

0:00:39.540000 --> 0:00:45.400000
 course so that again you have a very
 clear idea as to what you will know

0:00:45.400000 --> 0:00:48.720000
 and what you will be able to
 do by the end of the course.

0:00:48.720000 --> 0:00:52.000000
 So with that being said, let's get
 some of the formalities out of the

0:00:52.000000 --> 0:00:54.500000
 way. Who am I? My name is Alexis Ahmed.

0:00:54.500000 --> 0:00:58.160000
 I'm the Red Team and Blue Team
 instructor here at INE.

0:00:58.160000 --> 0:01:00.860000
 I'm also the Red Team Lead at HACUSPLOIT.


0:01:00.860000 --> 0:01:05.600000
 In terms of my experience, some of you
 may know me from my Red Team courses

0:01:05.600000 --> 0:01:10.700000
 here at INE. But some of you may not
 know that I also have experience

0:01:10.700000 --> 0:01:17.100000
 in the Blue Team having worked as an
 incident responder in a security

0:01:17.100000 --> 0:01:26.360000
 operations center before I actually
 went into a SOC from scratch for a

0:01:26.360000 --> 0:01:28.680000
 financial institution or a bank.

0:01:28.680000 --> 0:01:31.900000
 So this is an area that
 I do have experience in.

0:01:31.900000 --> 0:01:37.880000
 I also have quite a bit of experience
 in threat intelligence, you know,

0:01:37.880000 --> 0:01:41.920000
 essentially performing quite a bit of
 advanced cyber threat intelligence

0:01:41.920000 --> 0:01:47.980000
 for various companies, really with a
 focus on advanced persistent threats.

0:01:47.980000 --> 0:01:50.860000
 In any case, that's a
 little bit about me.

0:01:50.860000 --> 0:01:55.380000
 And let's get started by taking a look
 at some of the key concepts that

0:01:55.380000 --> 0:01:57.800000
 this course is sort of built on.

0:01:57.800000 --> 0:02:02.520000
 And you know, these will sort of set
 the stage or really act as primary

0:02:02.520000 --> 0:02:07.080000
 categories or sections that we'll be
 covering that of course include,

0:02:07.080000 --> 0:02:09.980000
 you know, various topics underneath them.


0:02:09.980000 --> 0:02:14.600000
 But to get started, the first key concept
 that we'll be addressing in

0:02:14.600000 --> 0:02:17.900000
 this course is to, you know, provide
 you with an introduction to security

0:02:17.900000 --> 0:02:23.160000
 operations. So this particular learning
 path is designed for incident

0:02:23.160000 --> 0:02:28.320000
 responders. And, you know, regardless
 of whether you already work as an

0:02:28.320000 --> 0:02:32.460000
 incident responder or are looking to
 be common incident responder, you

0:02:32.460000 --> 0:02:37.940000
 need to again be familiar with modern day
 security operations within organizations.

0:02:37.940000 --> 0:02:43.320000
 And also, you know, how modern day security
 operations centers work, which

0:02:43.320000 --> 0:02:48.740000
 brings me to the next key concept, which
 will be focused on again, understanding

0:02:48.740000 --> 0:02:53.040000
 the key functions and services of a
 SOC in essence, you know, what a SOC

0:02:53.040000 --> 0:02:58.980000
 is a modern day SOC how it works, what
 are the key services it provides,

0:02:58.980000 --> 0:03:03.620000
 etc, etc. And then of course, we'll
 build on top of that by getting an

0:03:03.620000 --> 0:03:08.220000
 understanding of the structure of a modern
 day SOC, which, you know, sort

0:03:08.220000 --> 0:03:17.720000
 of the processes, you know, as well,
 and we'll also be addressing the

0:03:17.720000 --> 0:03:20.180000
 technologies and threat intelligence.

0:03:20.180000 --> 0:03:25.600000
 So sort of the four pillars of the SOC
 or, you know, successful or operational

0:03:25.600000 --> 0:03:32.260000
 security operations center will also,
 you know, be focusing or we will

0:03:32.260000 --> 0:03:36.800000
 be taking a look at, you know, with
 quite a bit of detail, the various

0:03:36.800000 --> 0:03:41.180000
 SOC workflows and processes with a specific
 focus on incident response.

0:03:41.180000 --> 0:03:45.940000
 Again, given that this learning path
 is, you know, designed for incident

0:03:45.940000 --> 0:03:50.400000
 responders, what we're going to be, you
 know, going through is, you know,

0:03:50.400000 --> 0:03:55.200000
 get is firstly, you know, get an understanding
 of the role that incident

0:03:55.200000 --> 0:04:01.080000
 response plays within a security operation
 center, the incident response

0:04:01.080000 --> 0:04:06.720000
 lifecycle or workflow, and pretty much
 give you an idea as to what your

0:04:06.720000 --> 0:04:10.700000
 responsibilities are, you know, as
 an incident responder, what you're

0:04:10.700000 --> 0:04:13.620000
 required to do, etc, etc.

0:04:13.620000 --> 0:04:16.540000
 So we now turn our attention
 to the major topic.

0:04:16.540000 --> 0:04:20.000000
 So this gives you a bit more detail,
 you know, bit more of a detailed

0:04:20.000000 --> 0:04:23.920000
 view as to the, you know, again, as it
 states here, the major topics that

0:04:23.920000 --> 0:04:25.500000
 we'll be covering in this course.

0:04:25.500000 --> 0:04:29.620000
 So as I mentioned, key functions and
 services of a SOC will then also

0:04:29.620000 --> 0:04:33.900000
 take a look at the various types of
 SOCs or SOC deployments that you're

0:04:33.900000 --> 0:04:35.740000
 likely to run into.

0:04:35.740000 --> 0:04:41.980000
 And those are essentially determined
 by the size of the organization,

0:04:41.980000 --> 0:04:45.680000
 the maturity, the resources
 available, etc.

0:04:45.680000 --> 0:04:48.820000
 And then of course, I already mentioned,
 we'll take a look at the various

0:04:48.820000 --> 0:04:54.280000
 roles within a SOC team and the
 responsibilities of those roles.

0:04:54.280000 --> 0:05:00.220000
 And then we'll, we'll actually pay, or
 we'll explore in detail, you know,

0:05:00.220000 --> 0:05:04.340000
 incident detection and incident response
 and what that looks like.

0:05:04.340000 --> 0:05:09.940000
 And, you know, who does, who handles
 incident detection within a SOC team,

0:05:09.940000 --> 0:05:14.520000
 who does, or who handles incident response,
 how that works, that'll then

0:05:14.520000 --> 0:05:18.140000
 lead us into, you know, the SOC workflows
 and processes, which I already

0:05:18.140000 --> 0:05:23.980000
 described, will also be exploring or taking
 a look at the core or essential

0:05:23.980000 --> 0:05:25.840000
 SOC tools and technology.

0:05:25.840000 --> 0:05:33.900000
 So the various technologies or tools
 used in a SOC, for example, a CEDR,

0:05:33.900000 --> 0:05:37.100000
 IDS, IPS solutions, etc.

0:05:37.100000 --> 0:05:42.320000
 And we'll finally, you know, take a look
 at SOC automation and optimization.

0:05:42.320000 --> 0:05:48.520000
 So, you know, exploring playbooks, exploring
 SOAR, you know, as a concept

0:05:48.520000 --> 0:05:53.560000
 and also how SOAR platforms work to, you
 know, automate a lot of the repetitive

0:05:53.560000 --> 0:05:58.140000
 tasks, you know, performed by SOC analysts
 in general, but with a specific

0:05:58.140000 --> 0:06:01.280000
 focus on incident responders.

0:06:01.280000 --> 0:06:03.160000
 So those are the major topics.

0:06:03.160000 --> 0:06:05.960000
 And then finally, we come
 to the learning outcomes.

0:06:05.960000 --> 0:06:10.660000
 I should say last but not least, because
 we need to touch on the prerequisites.

0:06:10.660000 --> 0:06:17.280000
 But this is where I lay out what you
 will know by the end of this course.

0:06:17.280000 --> 0:06:19.100000
 So let's get started.

0:06:19.100000 --> 0:06:22.640000
 So firstly, by the end of this course,
 you should have an understanding

0:06:22.640000 --> 0:06:27.600000
 of the fundamentals of security operations
 and of a security operations

0:06:27.600000 --> 0:06:29.120000
 center. What does that mean?

0:06:29.120000 --> 0:06:33.160000
 You should be able to explain the purpose,
 structure and key functions

0:06:33.160000 --> 0:06:37.960000
 of a security operations center, including
 the different SOC models, namely

0:06:37.960000 --> 0:06:42.700000
 in-house managed or hybrid, as
 well as the SOC tiers or roles.

0:06:42.700000 --> 0:06:45.980000
 So, you know, the SOC tier
 1, 2, and 3 analysts.

0:06:45.980000 --> 0:06:50.000000
 Secondly, you know, you should have
 an understanding or you should be

0:06:50.000000 --> 0:06:55.840000
 able to identify key roles and teams
 within a SOC team or, you know, a

0:06:55.840000 --> 0:06:57.680000
 security operations center.

0:06:57.680000 --> 0:06:59.720000
 What does that mean specifically?

0:06:59.720000 --> 0:07:02.920000
 It means that you should be able to describe
 the roles and responsibilities

0:07:02.920000 --> 0:07:04.560000
 of SOC analysts.

0:07:04.560000 --> 0:07:10.820000
 So tier 1, 2, and 3, threat hunters,
 the digital forensics teams, CSERT,

0:07:10.820000 --> 0:07:14.840000
 or, you know, standard incident response
 teams, red teams, and also threat

0:07:14.840000 --> 0:07:16.460000
 intelligence teams.

0:07:16.460000 --> 0:07:21.460000
 Moving on. Thirdly, the third learning
 outcome is by the end of this course,

0:07:21.460000 --> 0:07:25.720000
 you should have an understanding of
 SOC frameworks and maturity models.

0:07:25.720000 --> 0:07:28.780000
 What that means is, you know, you should
 have an understanding of and

0:07:28.780000 --> 0:07:32.880000
 you should be able to compare various
 SOC maturity models and frameworks

0:07:32.880000 --> 0:07:38.140000
 in order to assess and improve the
 effectiveness of a SOC, as well as

0:07:38.140000 --> 0:07:44.160000
 the maturity. And then we have the fourth
 learning outcome, which is focused

0:07:44.160000 --> 0:07:47.960000
 on, you know, incident response and
 the incident response lifecycle.

0:07:47.960000 --> 0:07:52.420000
 So by the end of this course, you should
 be able to explain or detail

0:07:52.420000 --> 0:07:56.440000
 the phases of incident response of the
 incident response lifecycle according

0:07:56.440000 --> 0:08:03.260000
 to primarily the NIST 861 special publication,
 including, you know, the

0:08:03.260000 --> 0:08:07.240000
 various phases, so detection, containment,
 eradication, recovery, and

0:08:07.240000 --> 0:08:08.200000
 lessons learned.

0:08:08.200000 --> 0:08:12.440000
 So you should have an understanding
 of the incident response lifecycle

0:08:12.440000 --> 0:08:15.120000
 and the phases that make
 up that lifecycle.

0:08:15.120000 --> 0:08:21.380000
 And this is in alignment with the NIST
 861 special publication, just as

0:08:21.380000 --> 0:08:27.880000
 a, you know, sort of judge ourselves.

0:08:27.880000 --> 0:08:31.120000
 And then we have incident detection
 and response techniques.

0:08:31.120000 --> 0:08:36.260000
 So you should be able to describe or
 explain various IR incident response

0:08:36.260000 --> 0:08:41.620000
 techniques like event triage, investigation,
 investigation, webflows,

0:08:41.620000 --> 0:08:46.100000
 escalation, the escalation process and
 the escalation protocols, and of

0:08:46.100000 --> 0:08:49.880000
 course, different response strategies.

0:08:49.880000 --> 0:08:55.440000
 And then finally, the final learning
 outcome is focused on SOC tools and

0:08:55.440000 --> 0:08:59.000000
 automation. So by the end of this course,
 you should have an understanding

0:08:59.000000 --> 0:09:03.640000
 of essential SOC tools, technologies
 and automation techniques, including

0:09:03.640000 --> 0:09:07.860000
 SOA platforms, threat intelligence feeds,
 threat intelligence platforms

0:09:07.860000 --> 0:09:12.020000
 and the use of AI and machine learning
 to enhance SOC efficiency.

0:09:12.020000 --> 0:09:15.840000
 So those are the learning outcomes,
 we'll be revisiting these learning

0:09:15.840000 --> 0:09:19.220000
 outcomes in the course conclusion video.

0:09:19.220000 --> 0:09:22.620000
 So at the end of the course to see
 whether we actually covered all of

0:09:22.620000 --> 0:09:25.940000
 this in terms of knowledge domains.

0:09:25.940000 --> 0:09:29.640000
 But with that being said, what are
 the prerequisites for this course?

0:09:29.640000 --> 0:09:35.680000
 So given that this course is, you know,
 supposed to appeal to both a individuals

0:09:35.680000 --> 0:09:40.920000
 looking to work in a SOC, there's a tier
 one analyst or an incident responder,

0:09:40.920000 --> 0:09:48.000000
 as well as be, you know, people who
 already work in a SOC, again, either

0:09:48.000000 --> 0:09:53.120000
 as a SOC tier one or tier two analyst,
 the prerequisites are fairly simple,

0:09:53.120000 --> 0:09:58.340000
 because I'll be introducing you to, you
 know, pretty much all of the concepts.

0:09:58.340000 --> 0:10:02.600000
 But I would say you would, you require
 basic understanding of various

0:10:02.600000 --> 0:10:04.680000
 cybersecurity concepts and terminology.

0:10:04.680000 --> 0:10:06.900000
 So the standard lingo.

0:10:06.900000 --> 0:10:11.320000
 And I would also add that you need
 to have a foundational knowledge or

0:10:11.320000 --> 0:10:15.880000
 understanding of, you know, various
 types of threats and attack vectors.

0:10:15.880000 --> 0:10:19.360000
 There's really nothing or more that
 I would say you need to know.

0:10:19.360000 --> 0:10:23.440000
 As I said, this course is designed to introduce
 anyone who works in cybersecurity

0:10:23.440000 --> 0:10:30.080000
 to security operations, but more specifically,
 security operations centers

0:10:30.080000 --> 0:10:31.060000
 and how they work.

0:10:31.060000 --> 0:10:34.800000
 And of course, as I said, there's a
 bit of a focus on incident response,

0:10:34.800000 --> 0:10:37.940000
 given that that is the focus of
 the learning path in general.

0:10:37.940000 --> 0:10:43.920000
 But I think that this course, you know,
 really, there's really no additional

0:10:43.920000 --> 0:10:46.180000
 prerequisites I can think of.

0:10:46.180000 --> 0:10:48.760000
 So you don't need to worry there.

0:10:48.760000 --> 0:10:52.580000
 So with that being said, that's
 an overview of the course.

0:10:52.580000 --> 0:10:56.220000
 I'm really excited to get started and
 I'll be seeing you in the first

0:10:56.220000 --> 0:10:57.480000
 section of the course.