WEBVTT

0:00:03.940000 --> 0:00:10.120000
 Hello everyone and welcome to the
 first section of this course.

0:00:10.120000 --> 0:00:14.040000
 Now to get things going or to get started
 I should say we're going to

0:00:14.040000 --> 0:00:19.560000
 start off by getting an understanding
 of what a SOC is or I should say

0:00:19.560000 --> 0:00:22.420000
 a security operation center.

0:00:22.420000 --> 0:00:26.780000
 Now given you know that our primary focus
 in this learning path and certification

0:00:26.780000 --> 0:00:34.000000
 is incident response you may be asking
 yourself why is it important to

0:00:34.000000 --> 0:00:39.020000
 you know learn about the SOC or why do
 we have a whole course on the SOC.

0:00:39.020000 --> 0:00:47.020000
 Well the reason for that is again firstly
 in the event that you are interested

0:00:47.020000 --> 0:00:54.180000
 in working in the SOC and incident response
 or an incident response analyst

0:00:54.180000 --> 0:00:58.900000
 is a role that you know exists within
 a SOC you need to understand you

0:00:58.900000 --> 0:01:03.980000
 know how SOCs work the
 various roles etc etc.

0:01:03.980000 --> 0:01:08.800000
 The other reason why it's important
 is primarily because it'll give you

0:01:08.800000 --> 0:01:14.040000
 a better understanding of where incident
 response fits within a SOC and

0:01:14.040000 --> 0:01:19.380000
 you know in this case we're pretty much
 going to be utilizing the cutting

0:01:19.380000 --> 0:01:24.260000
 edge examples of SOCs to you know give
 you a better understanding of what

0:01:24.260000 --> 0:01:30.100000
 is required of you as an incident responder
 but with that being said let's

0:01:30.100000 --> 0:01:36.000000
 get started so what is a security operations
 center or a SOC well a SOC

0:01:36.000000 --> 0:01:42.420000
 is a centralized unit or team within
 an organizational company that is

0:01:42.420000 --> 0:01:48.520000
 responsible for monitoring detecting analyzing
 and responding to cybersecurity

0:01:48.520000 --> 0:01:55.060000
 threats across applications devices
 systems networks and locations so

0:01:55.060000 --> 0:01:59.380000
 you can see a SOC is responsible for
 quite a bit and over here you have

0:01:59.380000 --> 0:02:04.380000
 an image of you know that representative
 what a SOC looks like not a very

0:02:04.380000 --> 0:02:07.440000
 large one but a functional
 one nonetheless.

0:02:07.440000 --> 0:02:12.140000
 Now fundamentally speaking what I'm
 trying to you know to put across to

0:02:12.140000 --> 0:02:19.160000
 you is that a SOC is an organization's
 first line of defense essentially

0:02:19.160000 --> 0:02:24.400000
 functioning as the nerve center for
 all cybersecurity efforts within an

0:02:24.400000 --> 0:02:30.540000
 organization now given this critical role
 that a SOC plays within an organization

0:02:30.540000 --> 0:02:35.620000
 it goes without saying that it must operate
 or you know it should operate

0:02:35.620000 --> 0:02:41.560000
 but really it must operate around the
 clock which means 24 seven so you

0:02:41.560000 --> 0:02:44.460000
 know there's no downtime and that's
 when we'll you know be progressing

0:02:44.460000 --> 0:02:47.920000
 through this course you'll also know
 that you know if you already have

0:02:47.920000 --> 0:02:51.920000
 experience or you've worked within a
 SOC there's usually shifts all right

0:02:51.920000 --> 0:03:02.400000
 so you have people coming and going
 to ensure you and this is you know

0:03:02.400000 --> 0:03:08.240000
 in support of providing continuous security
 monitoring and rapid incident

0:03:08.240000 --> 0:03:14.940000
 response when and when and as required
 so you never want to you know you

0:03:14.940000 --> 0:03:20.000000
 don't want to have a SOC that's operational
 half half the time and miss

0:03:20.000000 --> 0:03:23.620000
 out on any potential alerts or you
 know in the event you get breached

0:03:23.620000 --> 0:03:27.980000
 you should have someone there or an
 analyst there to you know detect it

0:03:27.980000 --> 0:03:32.580000
 and then you know follow the procedures
 to escalate it and you know so

0:03:32.580000 --> 0:03:37.860000
 on and so forth so the next logical
 step that or you know question that

0:03:37.860000 --> 0:03:42.360000
 you might be having is okay given the
 importance of a SOC and you know

0:03:42.360000 --> 0:03:47.980000
 the the parameters you know that it
 should operate or the constraints

0:03:47.980000 --> 0:03:54.540000
 that it has set on it from an operational
 perspective if we were to look

0:03:54.540000 --> 0:03:58.700000
 at it from the you know the perspective
 of building a new SOC how would

0:03:58.700000 --> 0:04:02.960000
 you do this correctly or what's the
 correct way of building a SOC well

0:04:02.960000 --> 0:04:09.480000
 firstly we need to understand that a
 well-defined functional SOC is built

0:04:09.480000 --> 0:04:15.120000
 upon or relies on four essential pillars
 now in the past they were really

0:04:15.120000 --> 0:04:21.840000
 thought of as three pillars namely people
 processes tools but we now have

0:04:21.840000 --> 0:04:26.260000
 you know cyber threat intelligence so
 in reality there are four pillars

0:04:26.260000 --> 0:04:32.860000
 that sort of underpin a functional or
 operational SOC so the the pillars

0:04:32.860000 --> 0:04:38.840000
 as i've just stated are people processes
 tools and intelligence so i've

0:04:38.840000 --> 0:04:42.680000
 just summarized a couple of them here but
 we'll look at them shortly individually

0:04:42.680000 --> 0:04:48.020000
 i should say so skilled analysts and
 engineers form the human foundation

0:04:48.020000 --> 0:04:53.480000
 so whoever's working in the SOC are people
 right so that's the first pillar

0:04:53.480000 --> 0:04:58.400000
 and the second pillar to do with processes
 is the second part of this

0:04:58.400000 --> 0:05:04.260000
 sentence so these people utilize established
 protocols and workflows to

0:05:04.260000 --> 0:05:10.760000
 guide operations so just think of playbooks
 procedures you know essentially

0:05:10.760000 --> 0:05:15.320000
 checklists to follow that these people
 or analysts should follow when

0:05:15.320000 --> 0:05:20.700000
 you know a particular when a particular
 incident occurs you can you can

0:05:20.700000 --> 0:05:25.160000
 you can sort of see why it's a it's
 a pillar why processes is a pillar

0:05:25.160000 --> 0:05:28.800000
 of course we'll dive into this i'm
 just giving you an overview at the

0:05:28.800000 --> 0:05:33.860000
 moment you then have tools right so advanced
 security platforms and technologies

0:05:33.860000 --> 0:05:40.740000
 very helpful in enabling real-time monitoring
 detection and analysis of

0:05:40.740000 --> 0:05:44.440000
 potential threats right this is actually
 quite an important pillar because

0:05:44.440000 --> 0:05:49.260000
 you need to have the tools or technologies
 to actually you know monitor

0:05:49.260000 --> 0:05:55.760000
 systems you know detect intrusions and
 more importantly analyze potential

0:05:55.760000 --> 0:06:00.560000
 threats or intrusions and then finally
 which is sort of the new pillar

0:06:00.560000 --> 0:06:05.300000
 which is intelligence up-to-date threat
 intelligence keeps the SOC informed

0:06:05.300000 --> 0:06:10.040000
 about emerging this is very important
 so emerging attack methods which

0:06:10.040000 --> 0:06:16.540000
 helps ensure a proactive and adaptive
 defense posture so the bottom line

0:06:16.540000 --> 0:06:20.380000
 is that a SOC relies on these pillars
 to effectively protect you know

0:06:20.380000 --> 0:06:25.340000
 the organization or unorganization
 and each pillar is critical that's

0:06:25.340000 --> 0:06:29.860000
 very important is critical to the SOC's
 effectiveness or the effectiveness

0:06:29.860000 --> 0:06:35.400000
 of a security operation center so let's
 take a deeper look at these pillars

0:06:35.400000 --> 0:06:40.060000
 starting off with people which in you
 know reality is the SOC team so

0:06:40.060000 --> 0:06:45.180000
 the these are the individuals or roles
 required to operate a functional

0:06:45.180000 --> 0:06:50.960000
 SOC so as i mentioned a SOC requires
 skilled security analysts and or

0:06:50.960000 --> 0:06:55.580000
 engineers i should say and not and or
 and engineers to operate effectively

0:06:55.580000 --> 0:07:00.500000
 a functional SOC organizes and classifies
 members of the SOC team based

0:07:00.500000 --> 0:07:03.900000
 on their role and responsibilities
 so for example you have a tier one

0:07:03.900000 --> 0:07:07.820000
 tier two tier three analyst we'll get
 into the roles in another video

0:07:07.820000 --> 0:07:12.060000
 but for now i just want you to understand
 this pillar so the SOC team

0:07:12.060000 --> 0:07:17.140000
 that's pillar one second processes so
 what's this all about well processes

0:07:17.140000 --> 0:07:22.440000
 establish consistency and clarity ensuring
 incidents are handled methodically

0:07:22.440000 --> 0:07:28.180000
 so a functional SOC has defined workflows
 protocols and best practices

0:07:28.180000 --> 0:07:34.240000
 checklist as well you know to help ensure
 consistency and efficiency of

0:07:34.240000 --> 0:07:38.920000
 the operate of the operations right and
 this includes procedures for incident

0:07:38.920000 --> 0:07:43.320000
 response threat intelligence sharing
 and of course compliance reporting

0:07:43.320000 --> 0:07:49.780000
 you then have pillar three which is tools
 and technologies so this refers

0:07:49.780000 --> 0:07:53.740000
 to the technical you know this is the
 technical capabilities to detect

0:07:53.740000 --> 0:07:58.820000
 analyze and mitigate threats at scale
 what this is referring to is the

0:07:58.820000 --> 0:08:03.920000
 range of solutions or tools or technologies
 that you know are required

0:08:03.920000 --> 0:08:10.240000
 for the SOC team to perform its primary
 functions or to deliver its primary

0:08:10.240000 --> 0:08:15.780000
 services for example you need tools
 for asset discovery you need tools

0:08:15.780000 --> 0:08:20.100000
 for vulnerability assessment for intrusion
 detection and prevention so

0:08:20.100000 --> 0:08:25.820000
 your ideas IPS solutions you need a seem
 you need to have end point detection

0:08:25.820000 --> 0:08:31.220000
 and of course security analytics fairly
 simple quite important well not

0:08:31.220000 --> 0:08:36.480000
 quite without the tools you really don't
 have a SOC but moving on to the

0:08:36.480000 --> 0:08:40.340000
 fourth pillar this is intelligence right
 as i said it's quite new or when

0:08:40.340000 --> 0:08:45.060000
 i say new i mean it's fairly new it has
 been there although not officially

0:08:45.060000 --> 0:08:50.800000
 but now intelligence is treated as a pillar
 you know right from the inception

0:08:50.800000 --> 0:08:55.260000
 of a SOC when you're planning to build
 one out so what's all of this about

0:08:55.260000 --> 0:08:59.060000
 what is intelligence about well you
 know this involves supplying the SOC

0:08:59.060000 --> 0:09:06.520000
 you know the SOC team or the analysts
 specifically with intelligence you

0:09:06.520000 --> 0:09:11.300000
 know so that they can remain one step
 ahead of the adversaries and the

0:09:11.300000 --> 0:09:15.400000
 point here is that up to date threat
 intelligence equips the SOC with

0:09:15.400000 --> 0:09:19.400000
 insights into emerging attack vectors
 tactics and indicators of compromise

0:09:19.400000 --> 0:09:25.700000
 which guide proactive and reactive measures
 effectively all right so those

0:09:25.700000 --> 0:09:30.760000
 are the four pillars now the next question
 you may be having will okay

0:09:30.760000 --> 0:09:37.860000
 i know what a SOC is i know you know
 what's what it is comprised of in

0:09:37.860000 --> 0:09:44.000000
 terms of the pillars what does a SOC
 do or what are the services that

0:09:44.000000 --> 0:09:50.140000
 a SOC you know provides what functions
 does it provide well generally

0:09:50.140000 --> 0:09:53.640000
 speaking and i'm generalizing yeah
 although i think this list is quite

0:09:53.640000 --> 0:09:58.480000
 comprehensive a SOC is typically responsible
 for a broad range of services

0:09:58.480000 --> 0:10:03.840000
 or functions like you know a real-time
 security monitoring b thread detection

0:10:03.840000 --> 0:10:13.060000
 and c incident response d vulnerability
 management e forensics and f reporting

0:10:13.060000 --> 0:10:16.740000
 and compliance now i want to point
 out we'll get into this in the next

0:10:16.740000 --> 0:10:21.160000
 set of slides but these services or functions
 that are just outlined represent

0:10:21.160000 --> 0:10:26.080000
 categories of services that a SOC provides
 and is not representative of

0:10:26.080000 --> 0:10:29.540000
 all the functions or activities that
 fall under each of these categories

0:10:29.540000 --> 0:10:34.660000
 and we'll be taking a closer look at
 the primary SOC services in the next

0:10:34.660000 --> 0:10:39.220000
 set of slides so you know just to go
 over them again or to give you a

0:10:39.220000 --> 0:10:42.860000
 bit of a description or an understanding
 of each of them so security monitoring

0:10:42.860000 --> 0:10:47.800000
 i'm sort of showing you that each of
 those categories that are all those

0:10:47.800000 --> 0:10:53.520000
 categories of services that i outlined
 in the previous slides have activities

0:10:53.520000 --> 0:10:59.180000
 that fall under them so security monitoring
 entails continuous log collection

0:10:59.180000 --> 0:11:03.240000
 network monitoring threat intelligence
 this involves analyzing emerging

0:11:03.240000 --> 0:11:08.640000
 threats and attack trends threat hunting
 this involves proactive hunting

0:11:08.640000 --> 0:11:13.020000
 for undetected threats incident response
 you know detecting containing

0:11:13.020000 --> 0:11:18.060000
 and then of course eradicating threats digital
 forensics involves investigating

0:11:18.060000 --> 0:11:22.900000
 you know the security incidents post
 breach analyzing malware stuff like

0:11:22.900000 --> 0:11:27.240000
 this and then compliance and reporting
 this involves meeting regulatory

0:11:27.240000 --> 0:11:31.680000
 and audit requirements so the the point
 of this slide is to show you that

0:11:31.680000 --> 0:11:37.720000
 you know each of these core services has
 activities or a subset of activities

0:11:37.720000 --> 0:11:42.260000
 that fall under them and you know it's
 quite complex i just wanted to

0:11:42.260000 --> 0:11:46.880000
 start off very very simple and then
 move from there now before you even

0:11:46.880000 --> 0:11:51.880000
 dive into the minutiae of you know SOC
 services and what you know activities

0:11:51.880000 --> 0:11:56.020000
 fall under let's say incident response
 you need to understand that within

0:11:56.020000 --> 0:12:01.960000
 a SOC i should say a well-defined functional
 SOC these services are usually

0:12:01.960000 --> 0:12:07.200000
 categorized based on the operations they
 entail the nature of the operations

0:12:07.200000 --> 0:12:13.120000
 that they entail so what does that mean
 well the primary categorization

0:12:13.120000 --> 0:12:19.220000
 used is are the services reactive or
 proactive so what does that mean

0:12:19.220000 --> 0:12:23.600000
 well in the case of reactive services
 these are tasks or activities that

0:12:23.600000 --> 0:12:28.920000
 are triggered or are performed let's
 say after an intrusion so after so

0:12:28.920000 --> 0:12:35.060000
 you know reactive you're reacting or
 after an intrusion intrusion or a

0:12:35.060000 --> 0:12:38.540000
 malicious event is detected so again
 just think of an analyst working

0:12:38.540000 --> 0:12:45.220000
 in a SOC if they you know detect an
 intrusion they are then reacting to

0:12:45.220000 --> 0:12:50.080000
 that right you then have proactive services
 which involve tasks that are

0:12:50.080000 --> 0:12:53.780000
 performed by the SOC in the absence
 of any clear indicators of intrusion

0:12:53.780000 --> 0:12:59.340000
 so let's say there's no there's no
 there's nothing really solid or you

0:12:59.340000 --> 0:13:02.040000
 know there's nothing really concrete
 telling you that there's an intrusion

0:13:02.040000 --> 0:13:07.840000
 but you proactively decide to investigate
 something or there may be nothing

0:13:07.840000 --> 0:13:12.820000
 at all you know essentially performing
 tasks that are proactively you

0:13:12.820000 --> 0:13:16.940000
 know that are proactive in nature in in
 the improvement of the the organization

0:13:16.940000 --> 0:13:22.180000
 security so very very simple but that
 brings us to this table where you

0:13:22.180000 --> 0:13:28.280000
 know um you know have this uh you know
 this differentiator which gives

0:13:28.280000 --> 0:13:32.860000
 you an idea as to what is reactive
 and what is proactive within a SOC

0:13:32.860000 --> 0:13:37.980000
 so in the case of the reactive services
 you have alert handling and triage

0:13:37.980000 --> 0:13:42.920000
 incident response and analysis you know
 this i hope this makes sense this

0:13:42.920000 --> 0:13:48.140000
 is all stuff that you do this is all reactive
 these all reactive activities

0:13:48.140000 --> 0:13:54.680000
 right intrusion detection vulnerability
 management digital forensics these

0:13:54.680000 --> 0:14:00.380000
 are all stuff that are born out of you
 reacting to something so you then

0:14:00.380000 --> 0:14:04.880000
 have malware analysis reporting and
 compliance recovery and remediation

0:14:04.880000 --> 0:14:08.760000
 in the case of proactive services this
 is where you know you're sort of

0:14:08.760000 --> 0:14:13.720000
 on the offense if that makes sense um you
 know you have cyber threat intelligence

0:14:13.720000 --> 0:14:17.500000
 you have threat hunting you know that
 makes sense that is indeed proactive

0:14:17.500000 --> 0:14:23.120000
 you have network security monitoring
 logging and seam management that's

0:14:23.120000 --> 0:14:29.720000
 really platform health and monitoring
 um you know that involves monitoring

0:14:29.720000 --> 0:14:38.260000
 and managing your logging solutions
 as well as management and of course

0:14:38.260000 --> 0:14:43.300000
 proactive monitoring so we'll dive into
 all of these but hopefully you're

0:14:43.300000 --> 0:14:48.000000
 starting to see where you as an incident
 responder uh you you're starting

0:14:48.000000 --> 0:14:52.220000
 to understand where you fit into the the
 SOC now this is just the introduction

0:14:52.220000 --> 0:14:57.000000
 so i know that is not that clear but
 that brings us to the final section

0:14:57.000000 --> 0:15:00.700000
 of this video where i want to go over
 the key characteristics of a SOC

0:15:00.700000 --> 0:15:05.200000
 so we've talked about the pillars or
 you know what a SOC is what it does

0:15:05.200000 --> 0:15:11.880000
 um you know the pillars uh that it uh
 that a SOC is built on and relies

0:15:11.880000 --> 0:15:16.800000
 on i should say a good SOC but i want to
 point out some of the key characteristics

0:15:16.800000 --> 0:15:22.400000
 of a SOC so what distinguishes a good
 SOC you know which is non-functionally

0:15:22.400000 --> 0:15:27.460000
 it really can be called a SOC uh from
 one that's um what differentiates

0:15:27.460000 --> 0:15:33.220000
 a bad one from a good one right or what
 are the key features of a functional

0:15:33.220000 --> 0:15:37.540000
 SOC now why is this important well understanding
 the key characteristics

0:15:37.540000 --> 0:15:42.760000
 of a SOC is essential because it provides
 a foundational framework for

0:15:42.760000 --> 0:15:48.720000
 how security operations function and
 how this is very important how a

0:15:48.720000 --> 0:15:53.860000
 SOC or SOCs should operate more importantly
 these characteristics will

0:15:53.860000 --> 0:15:58.880000
 be very useful in establishing a baseline
 that can be used to determine

0:15:58.880000 --> 0:16:03.480000
 whether a SOC is indeed functional
 so you know in your case if you are

0:16:03.480000 --> 0:16:07.500000
 a SOC analyst you can use these characteristics
 to say well are we really

0:16:07.500000 --> 0:16:12.220000
 a functional SOC are we really doing
 what we should uh what we should

0:16:12.220000 --> 0:16:16.020000
 be doing now of course this what i'm going
 to show you these characteristics

0:16:16.020000 --> 0:16:22.800000
 are you know taken from personal experience
 having built two SOCs uh personally

0:16:22.800000 --> 0:16:28.300000
 or being involved in that process but
 also you know based on what is what

0:16:28.300000 --> 0:16:34.800000
 the industry standards are um so the
 bottom line is you know this will

0:16:34.800000 --> 0:16:38.880000
 be very useful in establishing a baseline
 that can be used to determine

0:16:38.880000 --> 0:16:42.540000
 whether a SOC is indeed functional and
 more importantly to identify where

0:16:42.540000 --> 0:16:46.260000
 improvements can be made so you can always
 refer back to these characteristics

0:16:46.260000 --> 0:16:52.640000
 just as a you know a guiding light or
 a framework for saying are we doing

0:16:52.640000 --> 0:16:59.100000
 this well or not you know and are there
 areas that we can improve so getting

0:16:59.100000 --> 0:17:05.020000
 started the first characteristic is
 the centralized command center what

0:17:05.020000 --> 0:17:10.860000
 does this mean well what i'm referring
 to here is that a SOC is or should

0:17:10.860000 --> 0:17:16.260000
 be centralized so a SOC operates as
 a single centralized unit or team

0:17:16.260000 --> 0:17:21.600000
 that's responsible for an organization's
 cybersecurity defense right so

0:17:21.600000 --> 0:17:26.120000
 what are the key characteristics uh
 that um relate to the centralized

0:17:26.120000 --> 0:17:32.600000
 command center notion or idea well firstly
 24 seven operations a SOC should

0:17:32.600000 --> 0:17:37.300000
 function around the clock 24 seven in
 order to detect and respond to threats

0:17:37.300000 --> 0:17:43.520000
 immediately that's you know without that
 it's not really a SOC and i know

0:17:43.520000 --> 0:17:47.560000
 there's some exceptions but if you know
 you really can't call a SOC functional

0:17:47.560000 --> 0:17:52.960000
 or effective if you have you know if
 you're up 18 hours or even six out

0:17:52.960000 --> 0:17:57.640000
 of seven days of the week secondly
 unified security infrastructure so

0:17:57.640000 --> 0:18:03.660000
 a SOC should integrate multiple security
 tools such as a SEAM EDRs I IDS

0:18:03.660000 --> 0:18:08.620000
 IPS so intrusion detection and intrusion
 prevention systems and firewalls

0:18:08.620000 --> 0:18:14.020000
 to provide a holistic view of security events
 so if you just have a vulnerability

0:18:14.020000 --> 0:18:17.900000
 scanner it's not really a SOC if you're
 just doing basic SISmon logging

0:18:17.900000 --> 0:18:24.400000
 it's not a SOC or i should say it's
 not a functional SOC third real-time

0:18:24.400000 --> 0:18:30.540000
 threat intelligence so centralized visibility
 allows the SOC team to correlate

0:18:30.540000 --> 0:18:35.400000
 events detect patterns and respond proactively
 so there should be a real

0:18:35.400000 --> 0:18:40.100000
-time threat intelligence feed that's
 providing you with up-to-date you

0:18:40.100000 --> 0:18:44.660000
 know intelligence you don't want to be
 you you don't want to be utilizing

0:18:44.660000 --> 0:18:48.980000
 outdated intelligence or a system where
 you check for you know the latest

0:18:48.980000 --> 0:18:53.900000
 threat intelligence after a month because
 again threat actors are constantly

0:18:53.900000 --> 0:18:59.180000
 evolving so that's something that's
 also very very important you then

0:18:59.180000 --> 0:19:05.060000
 have incident coordination so security teams,
 IT teams and executive stakeholders

0:19:05.060000 --> 0:19:11.400000
 rely on the SOC for security event
 updates and response actions right

0:19:11.400000 --> 0:19:17.500000
 so what does this mean it means that
 they should be proper coordination

0:19:17.500000 --> 0:19:22.620000
 between the SOC you know security teams
 IT teams and of course executive

0:19:22.620000 --> 0:19:28.740000
 stakeholders because they rely on this
 information from the SOC so that's

0:19:28.740000 --> 0:19:39.600000
 one you know characteristic the for real
-time monitoring of network traffic

0:19:39.600000 --> 0:19:44.080000
 system logs endpoints in cloud environments
 to detect malicious activity

0:19:44.080000 --> 0:19:50.160000
 so what are the key factors or characteristics
 here you know that relate

0:19:50.160000 --> 0:19:55.180000
 to this idea or you know the the practice
 of continuous monitoring well

0:19:55.180000 --> 0:20:00.860000
 firstly log collection and analysis
 so this goes without saying that a

0:20:00.860000 --> 0:20:08.840000
 SOC should aggregate logs from firewalls
 secondly alerting and threat

0:20:08.840000 --> 0:20:14.140000
 prioritization this is very very important
 so a SOC should utilize you

0:20:14.140000 --> 0:20:19.780000
 know a SEAMs or a SEAM to generate alerts
 and prioritize security incidents

0:20:19.780000 --> 0:20:24.240000
 if there's no prioritization even if
 you have a SEAM what do you know

0:20:24.240000 --> 0:20:30.200000
 or how do you how do you know what to
 action or triage first or you know

0:20:30.200000 --> 0:20:35.220000
 before you even get into triage how do
 you know whether some things actually

0:20:35.220000 --> 0:20:39.260000
 happen you need to write rules right
 or you need to you know you need

0:20:39.260000 --> 0:20:44.240000
 to you need to write rules for specific
 events so on and so forth you

0:20:44.240000 --> 0:20:48.380000
 they also have threat intelligence
 here but in the form of feeds so a

0:20:48.380000 --> 0:20:52.820000
 SOC should incorporate global threat
 intelligence sources to detect known

0:20:52.820000 --> 0:20:56.260000
 indicators of compromised soap again
 you should always be up to date with

0:20:56.260000 --> 0:21:00.960000
 the latest IOCs you then have behavioral
 analytics and machine learning

0:21:00.960000 --> 0:21:05.680000
 now this is not that important but it's
 becoming quite relevant so a SOC

0:21:05.680000 --> 0:21:09.480000
 should have a normally based detection
 capabilities in order to monitor

0:21:09.480000 --> 0:21:14.080000
 user behavior and insider threats through
 use and entity behavior analytics

0:21:14.080000 --> 0:21:19.680000
 or ueba as it's known now we don't really
 need to worry about that right

0:21:19.680000 --> 0:21:23.680000
 now but that is quite important we'll
 probably take a look at it later

0:21:23.680000 --> 0:21:29.780000
 on in this course and again more importantly
 or more important than than

0:21:29.780000 --> 0:21:33.840000
 that even is network endpoint monitoring
 so without this again do you

0:21:33.840000 --> 0:21:39.320000
 really have a SOC if there's no if you
 don't have an EDR but let me explain

0:21:39.320000 --> 0:21:44.360000
 the point first so a SOC should integrate
 network detection and response

0:21:44.360000 --> 0:21:49.800000
 or NDR and endpoint detection and response
 known as EDR tools to track

0:21:49.800000 --> 0:21:58.780000
 suspicious activity on you know different
 systems workstations to explain

0:21:58.780000 --> 0:22:03.640000
 here is if you were to try and judge
 whether a SOC is indeed functional

0:22:03.640000 --> 0:22:10.140000
 or is really a SOC then I would look
 for firstly you know the centralized

0:22:10.140000 --> 0:22:15.600000
 command center nature or you know the
 aspects of that I would also look

0:22:15.600000 --> 0:22:19.580000
 for its continuous monitoring capabilities
 in the form of lock collection

0:22:19.580000 --> 0:22:28.260000
 and analysis alerting and threat prioritization
 so on and so forth and

0:22:28.260000 --> 0:22:33.120000
 for the incident response and containment
 capability so given that that's

0:22:33.120000 --> 0:22:38.240000
 one of its core services you know in this
 case incident response and containment

0:22:38.240000 --> 0:22:45.580000
 in this particular you know given I'll
 just use the description here one

0:22:45.580000 --> 0:22:48.760000
 of the SOCs most critical functions is
 rapidly responding to cybersecurity

0:22:48.760000 --> 0:22:53.520000
 incidents to minimize damage contain the
 threat and you know prevent escalation

0:22:53.520000 --> 0:22:59.380000
 given that that's the case what are the
 key things that you know you should

0:22:59.380000 --> 0:23:04.780000
 look at either when you're building a
 SOC or when you're sort of assessing

0:23:04.780000 --> 0:23:10.400000
 your own or the one you work in the first
 is incident handling capabilities

0:23:10.400000 --> 0:23:14.560000
 so SOC analysts should follow a structured
 incident response process that's

0:23:14.560000 --> 0:23:20.260000
 based on either the NIST 861 or SANS
 guidelines don't worry we'll go over

0:23:20.260000 --> 0:23:25.080000
 both of them in this course secondly the
 SOC should have containment strategies

0:23:25.080000 --> 0:23:30.220000
 so a SOC team should be able to quarantine
 compromised systems revoke

0:23:30.220000 --> 0:23:35.420000
 access or block malicious IPs or domains
 you then have eradication and

0:23:35.420000 --> 0:23:39.660000
 remediation which again very very important
 so a SOC team should be able

0:23:39.660000 --> 0:23:43.920000
 to remove malware or I should say eradicate
 malware patch vulnerabilities

0:23:43.920000 --> 0:23:49.600000
 and strengthen security controls forensic
 investigation so a SOC team

0:23:49.600000 --> 0:23:53.580000
 should be able to collect digital evidence
 analyze malware and track the

0:23:53.580000 --> 0:23:57.000000
 origin of an attack if you don't have
 those capabilities you can't even

0:23:57.000000 --> 0:24:01.940000
 analyze a phishing you know malicious
 phishing attachment you and you

0:24:01.940000 --> 0:24:06.000000
 know there may be instances where you
 know an analyst may have flagged

0:24:06.000000 --> 0:24:10.380000
 a particular attachment you know that
 an employee downloaded or got through

0:24:10.380000 --> 0:24:14.780000
 an email you need to be able to analyze
 where it came from you know but

0:24:14.780000 --> 0:24:20.420000
 then finally incident documentation
 and reporting so a SOC as a whole

0:24:20.420000 --> 0:24:24.140000
 should be able to prepare post-incident
 reports for executive stakeholders

0:24:24.140000 --> 0:24:31.020000
 and legal teams and then finally coordination
 and collaboration so the

0:24:31.020000 --> 0:24:36.640000
 core point here is that a SOC does not
 operate in isolation it requires

0:24:36.640000 --> 0:24:40.680000
 close collaboration with multiple departments
 to ensure an effective security

0:24:40.680000 --> 0:24:45.780000
 posture so in this particular case what
 are the key features or factors

0:24:45.780000 --> 0:24:49.760000
 so firstly collaboration with IT team
 so the SOC should be able to work

0:24:49.760000 --> 0:24:54.300000
 with system administrators devops and
 network engineers to apply patches

0:24:54.300000 --> 0:24:59.300000
 and force security controls and maintain
 business continuity very very

0:24:59.300000 --> 0:25:04.280000
 important secondly communication with
 executive leadership so SOC managers

0:25:04.280000 --> 0:25:08.580000
 should be able to provide security reports
 risk assessments and incident

0:25:08.580000 --> 0:25:14.020000
 impact analysis to the executive team
 very very important you know all

0:25:14.020000 --> 0:25:17.880000
 of these are important but this is
 typically what I look for you know

0:25:17.880000 --> 0:25:24.260000
 if I'm sort of judging or rating the
 effectiveness of a SOC so you then

0:25:24.260000 --> 0:25:27.620000
 have compliance and legal coordination
 so a SOC should ensure compliance

0:25:27.620000 --> 0:25:35.040000
 with industry regulation so GDPR, hyper
 BCIDSS ISO 2701 and should be

0:25:35.040000 --> 0:25:39.200000
 able to work with legal teams for incident
 disclosure in the event there

0:25:39.200000 --> 0:25:43.880000
 is you know an incident or an intrusion
 you then have security awareness

0:25:43.880000 --> 0:25:47.700000
 in training this is not that important
 but it's always good to have you

0:25:47.700000 --> 0:25:52.820000
 know SOC should always should be able
 to work with HR and employees to

0:25:52.820000 --> 0:25:58.620000
 reduce human risk you know such as
 or I should say an example of this

0:25:58.620000 --> 0:26:01.840000
 would be you know the form of phishing
 attacks in social engineering scams

0:26:01.840000 --> 0:26:06.200000
 so they should be actively engaging
 with employees to tell them what to

0:26:06.200000 --> 0:26:12.020000
 do what not to do how to look out for
 you know weird or malicious emails

0:26:12.020000 --> 0:26:18.300000
 and attachments how to you know how to
 analyze emails to you know determine

0:26:18.300000 --> 0:26:24.120000
 if you know if it is a phishing if
 it does look like a phishing email

0:26:24.120000 --> 0:26:28.460000
 and if they do find it that you know
 they should bring it to the SOC to

0:26:28.460000 --> 0:26:35.700000
 investigate and analyze so there should
 be this dynamic relationship or

0:26:35.700000 --> 0:26:41.340000
 collaboration between not just you know
 the executive team but also the

0:26:41.340000 --> 0:26:46.680000
 HR department and employees in general
 and then finally continuous security

0:26:46.680000 --> 0:26:50.700000
 improvement so again this goes without
 saying that a SOC should share

0:26:50.700000 --> 0:26:55.040000
 lessons learned from past incidents to
 refine security policies and defense

0:26:55.040000 --> 0:26:59.180000
 strategies and the core point here
 is that if you don't learn as a SOC

0:26:59.180000 --> 0:27:10.860000
 or as a SOC analyst then there's no
 all of the all of the lessons that

0:27:10.860000 --> 0:27:14.180000
 have been learned either from you know
 a particular intrusion or attempted

0:27:14.180000 --> 0:27:20.500000
 intrusion or whatever should be should
 be fed back into the SOC in the

0:27:20.500000 --> 0:27:26.940000
 form of you know mitigations stuff like
 this so I would say that coordination

0:27:26.940000 --> 0:27:30.520000
 and collaboration is also something that
 I look for because you know really

0:27:30.520000 --> 0:27:34.880000
 the the social aspect of the people
 aspect the pillar if you will the

0:27:34.880000 --> 0:27:40.440000
 people pillar really plays a massive
 role in you know the effectiveness

0:27:40.440000 --> 0:27:44.940000
 of a SOC team but with that being said
 that's going to be it for this

0:27:44.940000 --> 0:27:49.720000
 video hopefully you now have a proper
 introduction or you know what a

0:27:49.720000 --> 0:27:53.480000
 security operation center is with that
 being said that's going to be it