WEBVTT

0:00:03.500000 --> 0:00:07.700000
 Hello everyone and welcome to the introduction
 to Security Operations

0:00:07.700000 --> 0:00:11.680000
 Centre course summary I should say.

0:00:11.680000 --> 0:00:16.620000
 So, this is the final video in this
 course and arguably a very important

0:00:16.620000 --> 0:00:23.760000
 video because this is where we get
 to see a summary of everything that

0:00:23.760000 --> 0:00:28.700000
 we've covered and sort of measure our
 progress from the beginning of the

0:00:28.700000 --> 0:00:33.860000
 course and see exactly what we've learned
 and will also be revisiting

0:00:33.860000 --> 0:00:37.840000
 the learning outcomes to see whether we
 covered everything that I'd initially

0:00:37.840000 --> 0:00:42.760000
 laid out as the primary learning outcomes
 in the course introduction or

0:00:42.760000 --> 0:00:45.180000
 the course overview video.

0:00:45.180000 --> 0:00:50.540000
 So, we'll start off by revisiting the
 key concepts that again, pretty

0:00:50.540000 --> 0:00:55.140000
 much exactly the same as what we laid
 out in the course overview video.

0:00:55.140000 --> 0:00:58.980000
 So, introduction to security operations
 which we covered key functions

0:00:58.980000 --> 0:01:01.240000
 and services of a SOC.

0:01:01.240000 --> 0:01:04.840000
 We had a whole section on that as well.

0:01:04.840000 --> 0:01:09.080000
 The SOC structure and roles we pretty
 much covered, you know, I would

0:01:09.080000 --> 0:01:14.020000
 say all roles that you typically see
 in a SOC even some of the specialty

0:01:14.020000 --> 0:01:22.340000
 teams or roles like, you know, threat
 hunting, digital forensics, etc.

0:01:22.340000 --> 0:01:26.960000
 etc. And then the SOC workflows and processes
 we pretty much covered everything

0:01:26.960000 --> 0:01:34.720000
 from incident detection, the incident response
 workflow, threat intelligence,

0:01:34.720000 --> 0:01:40.240000
 you know, the process of the process
 of detection which I just mentioned,

0:01:40.240000 --> 0:01:56.140000
 threat intelligence, threat hunting,
 all of the things that we've done.

0:01:56.140000 --> 0:01:57.460000
 So, we've done a lot of the workflows
 that we've done in the course overview

0:01:57.460000 --> 0:02:00.560000
 video. So, we've done a lot of the workflows
 that we've done in the course

0:02:00.560000 --> 0:02:03.740000
 overview video. So, we'll
 start with the first one.

0:02:03.740000 --> 0:02:06.740000
 By the end of the course, you know,
 you should have an understanding of

0:02:06.740000 --> 0:02:10.680000
 the fundamentals of a SOC or
 security operations center.

0:02:10.680000 --> 0:02:14.040000
 So, you should be able to explain the
 purpose structure and key functions

0:02:14.040000 --> 0:02:18.480000
 of a SOC, including different SOC models
 in house managed hybrid and SOC

0:02:18.480000 --> 0:02:20.480000
 tiers tier one, two and three.

0:02:20.480000 --> 0:02:25.080000
 And indeed, we covered that in quite
 a bit of detail, going even a bit

0:02:25.080000 --> 0:02:30.780000
 further to sort of outline the escalation
 process between, you know, specifically

0:02:30.780000 --> 0:02:35.920000
 the SOC tiers or roles like, you know,
 tier one to tier two to tier three,

0:02:35.920000 --> 0:02:46.900000
 as well as various examples and, you know,
 escalation or interaction between

0:02:46.900000 --> 0:02:50.820000
 these roles looks like
 during an incident.

0:02:50.820000 --> 0:02:53.740000
 So, I think we dealt with
 that one quite well.

0:02:53.740000 --> 0:02:55.200000
 And hopefully you agree.

0:02:55.200000 --> 0:02:59.360000
 Secondly, by the end of the course,
 you should be able to identify the

0:02:59.360000 --> 0:03:01.680000
 key roles and teams within a SOC.

0:03:01.680000 --> 0:03:04.900000
 So, you know, you should be able to describe
 the roles and responsibilities

0:03:04.900000 --> 0:03:10.120000
 of SOC analysts, threat hunters, digital
 forensics teams, CSERT, IRT,

0:03:10.120000 --> 0:03:11.760000
 red teams and threat intelligence teams.

0:03:11.760000 --> 0:03:14.040000
 So, again, same thing here.

0:03:14.040000 --> 0:03:18.800000
 In addition to the SOC tier one, two
 and three analysts, we also took

0:03:18.800000 --> 0:03:24.620000
 a look at, you know, the various other
 teams or roles that have to do

0:03:24.620000 --> 0:03:26.600000
 with threat hunting, digital forensics.

0:03:26.600000 --> 0:03:31.360000
 And we also took a look at the various
 types of incident response teams

0:03:31.360000 --> 0:03:33.160000
 and how they are classified.

0:03:33.160000 --> 0:03:38.700000
 So, you know, CSERT, IRT, we also took
 a look at the roles of red teams

0:03:38.700000 --> 0:03:43.400000
 and threat intelligence teams and how
 they interact with the SOC, you

0:03:43.400000 --> 0:03:46.580000
 know, in the case of red teams, how
 they interact and collaborate with

0:03:46.580000 --> 0:03:51.920000
 each other, you know, in adverse remulation
 campaigns or even, you know,

0:03:51.920000 --> 0:03:57.480000
 really adverse remulation campaigns and
 how the threat intelligence teams

0:03:57.480000 --> 0:04:05.980000
 operate and how they continually enrich
 the SOC with data, you know, for

0:04:05.980000 --> 0:04:07.940000
 correlation, etc., etc.

0:04:07.940000 --> 0:04:11.320000
 So, we dealt with that pretty much 100%.

0:04:11.320000 --> 0:04:15.960000
 So, there's no qualms on my end with
 regards to that learning outcome.

0:04:15.960000 --> 0:04:18.180000
 And of course, I hope you agree.

0:04:18.180000 --> 0:04:22.060000
 The third learning outcome was focused
 on, you know, having an understanding

0:04:22.060000 --> 0:04:24.480000
 of SOC frameworks and maturity models.

0:04:24.480000 --> 0:04:28.960000
 And indeed, we dealt with that, I would
 say, quite extensively because

0:04:28.960000 --> 0:04:33.000000
 we not only went over the various mature
 or just, you know, one or two

0:04:33.000000 --> 0:04:38.320000
 maturity models, we went over pretty
 the most popular, the most widely

0:04:38.320000 --> 0:04:40.400000
 used and implemented.

0:04:40.400000 --> 0:04:44.500000
 And we took a look at how these maturity
 models and frameworks can be

0:04:44.500000 --> 0:04:50.060000
 used to assess, you know, the maturity
 level and effectiveness of a SOC,

0:04:50.060000 --> 0:04:53.900000
 but also how they can be used to improve
 the maturity and effectiveness

0:04:53.900000 --> 0:04:56.300000
 of a security operations center.

0:04:56.300000 --> 0:05:00.720000
 So, I think we dealt with that again,
 quite or, you know, pretty much

0:05:00.720000 --> 0:05:03.120000
 as extensively as possible.

0:05:03.120000 --> 0:05:07.520000
 And then moving on to the other learning
 outcome, which was to do with

0:05:07.520000 --> 0:05:12.060000
 being able to explain the instant
 response lifecycle.

0:05:12.060000 --> 0:05:16.140000
 And in this case, you know, you should
 be able to detail the phases of

0:05:16.140000 --> 0:05:21.680000
 the instant response lifecycle according
 to the NIST 861 special publication.

0:05:21.680000 --> 0:05:25.900000
 The phases being detection, containment,
 eradication, recovery and lessons

0:05:25.900000 --> 0:05:28.840000
 learned. And indeed, we
 dealt with detection.

0:05:28.840000 --> 0:05:34.120000
 We also explained containment eradication
 using these were all backed

0:05:34.120000 --> 0:05:39.540000
 up using various fictional examples
 and scenarios that helped, you know,

0:05:39.540000 --> 0:05:43.880000
 explain what each of these phases looks
 like from the perspective of an

0:05:43.880000 --> 0:05:45.320000
 instant responder.

0:05:45.320000 --> 0:05:51.340000
 You know, and we did this using fictional
 examples, but also outlined

0:05:51.340000 --> 0:05:55.860000
 some, you know, very key nuanced
 aspects of certain phases.

0:05:55.860000 --> 0:06:01.000000
 You know, like, for example, eradication
 and, you know, how this would

0:06:01.000000 --> 0:06:08.160000
 differ, you know, from when eradicating,
 let's say a simple or low complexity

0:06:08.160000 --> 0:06:14.640000
 threat. And now that would differ from,
 you know, eradication when you're

0:06:14.640000 --> 0:06:16.700000
 dealing with a ransomware incident.

0:06:16.700000 --> 0:06:19.400000
 So we covered that again
 in quite a bit of detail.

0:06:19.400000 --> 0:06:24.900000
 We also had a dedicated video explaining
 the incident response lifecycle

0:06:24.900000 --> 0:06:30.080000
 as it is outlined in the NIST
 861 special publication.

0:06:30.080000 --> 0:06:36.060000
 So I'm very happy with that, with, you
 know, the work we did with regards

0:06:36.060000 --> 0:06:37.680000
 to that learning outcome.

0:06:37.680000 --> 0:06:41.980000
 We then have, in this case, the fifth
 learning outcome, which deals with

0:06:41.980000 --> 0:06:45.240000
 incident detection and response techniques
 or, you know, understanding

0:06:45.240000 --> 0:06:50.720000
 the incident detection and response techniques
 like event triage, investigation,

0:06:50.720000 --> 0:06:53.260000
 workflows, escalation protocols
 and response strategies.

0:06:53.260000 --> 0:06:58.220000
 We actually went a step further by
 also talking about escalation and,

0:06:58.220000 --> 0:07:00.940000
 you know, prioritization of events.

0:07:00.940000 --> 0:07:03.700000
 So we also covered that one extensively.

0:07:03.700000 --> 0:07:05.900000
 We didn't leave anything out there.

0:07:05.900000 --> 0:07:08.640000
 And then finally, sock
 tools and automation.

0:07:08.640000 --> 0:07:12.000000
 So by the end of this course, you should
 have an understanding of essential

0:07:12.000000 --> 0:07:17.440000
 sock tools, technologies and automation
 techniques, including saw platforms,

0:07:17.440000 --> 0:07:20.060000
 threat intelligence, intelligence feeds
 and the use of AI and machine

0:07:20.060000 --> 0:07:22.140000
 learning to enhance sock efficiency.

0:07:22.140000 --> 0:07:26.980000
 So again, in the case of the essential
 sock tools, we explained or we

0:07:26.980000 --> 0:07:32.120000
 got to understand what seams are, how
 they work, how they used in a sock,

0:07:32.120000 --> 0:07:36.540000
 EDRs, the same for EDRs,
 NDRs, IDS, IPS solutions.

0:07:36.540000 --> 0:07:40.920000
 And we also had a dedicated video on
 the saw platforms, you know, how

0:07:40.920000 --> 0:07:43.000000
 it works, how it's used in the sock.

0:07:43.000000 --> 0:07:47.720000
 We also covered playbooks, threat
 intelligence feeds and platforms.

0:07:47.720000 --> 0:07:51.340000
 So we actually went above and beyond with
 regards to that learning outcome.

0:07:51.340000 --> 0:07:54.500000
 So overall, I think we
 covered everything.

0:07:54.500000 --> 0:07:57.400000
 I'm going to leave the final
 judgment with you.

0:07:57.400000 --> 0:08:02.220000
 But hopefully, you know, you found value
 in this course, you know, going

0:08:02.220000 --> 0:08:05.620000
 beyond the learning outcomes that we
 covered a lot more than what I laid

0:08:05.620000 --> 0:08:06.720000
 out in the learning outcomes.

0:08:06.720000 --> 0:08:13.160000
 But these sort of represent what I think
 or thought, you know, were the

0:08:13.160000 --> 0:08:17.460000
 most important takeaways for you, which
 will then lead them to the next

0:08:17.460000 --> 0:08:21.100000
 course or series of courses
 within this learning part.

0:08:21.100000 --> 0:08:25.520000
 So we sort of set the foundation for
 the other courses within the learning

0:08:25.520000 --> 0:08:30.200000
 path, which will be primarily focused
 on primarily focused on instant

0:08:30.200000 --> 0:08:34.580000
 response. So you now pretty much have
 the foundation that you require

0:08:34.580000 --> 0:08:39.600000
 and, you know, concepts like incident
 response will not seem, you know,

0:08:39.600000 --> 0:08:44.060000
 daunting or new to you when we get
 into, you know, the first phases of

0:08:44.060000 --> 0:08:46.160000
 instant response in their
 respective courses.

0:08:46.160000 --> 0:08:49.280000
 In any case, those are
 the learning outcomes.

0:08:49.280000 --> 0:08:52.800000
 And finally, I have a, you know, set
 of next steps that I would recommend

0:08:52.800000 --> 0:08:57.500000
 you take, you know, in order to improve
 your understanding of what we

0:08:57.500000 --> 0:09:02.560000
 covered in this course, but also to help
 expand your knowledge, you know,

0:09:02.560000 --> 0:09:06.460000
 and branch out and, you know, even
 specialize and learn more.

0:09:06.460000 --> 0:09:10.860000
 These are specifically tied to references
 that I mentioned within the

0:09:10.860000 --> 0:09:16.180000
 course. So, you know, for example,
 the incident response frameworks, I

0:09:16.180000 --> 0:09:21.560000
 would highly recommend that you study
 or read the NIST 861 incident response

0:09:21.560000 --> 0:09:26.280000
 lifecycle and compare it with other
 industry standard frameworks.

0:09:26.280000 --> 0:09:31.380000
 And, you know, go beyond just using it
 to learn about the incident response

0:09:31.380000 --> 0:09:36.520000
 lifecycle. There's a lot more information
 there that is extremely useful.

0:09:36.520000 --> 0:09:41.540000
 I would also recommend that you explore,
 well, it doesn't need to be practically,

0:09:41.540000 --> 0:09:46.400000
 but perform research about, you know,
 the SOC automation tools, like the

0:09:46.400000 --> 0:09:51.680000
 SOA platforms, you know, there's many
 resources you can find online that,

0:09:51.680000 --> 0:09:55.480000
 you know, you can use to learn
 more about them, how they work.

0:09:55.480000 --> 0:10:00.040000
 In any case, we will be investigating
 pretty much most of the tools that

0:10:00.040000 --> 0:10:04.440000
 I mentioned in this course, practically
 in the form of labs in the next

0:10:04.440000 --> 0:10:08.720000
 set of courses. So, you know, I would,
 the only reason why I'm making

0:10:08.720000 --> 0:10:12.800000
 this recommendation is so that you're
 familiar with it before we get to

0:10:12.800000 --> 0:10:15.540000
 actually using a SOA
 interacting with one.

0:10:15.540000 --> 0:10:18.960000
 And then finally, this is
 very, very important.

0:10:18.960000 --> 0:10:22.920000
 It's very close to my heart, given
 that I, you know, do quite a bit of

0:10:22.920000 --> 0:10:24.840000
 threat intelligence work.

0:10:24.840000 --> 0:10:27.980000
 And that is to examine threat
 intelligence platforms.

0:10:27.980000 --> 0:10:31.940000
 I would highly recommend, again, this
 is just my recommendation, open

0:10:31.940000 --> 0:10:34.420000
 CTI, which I mentioned in the course.

0:10:34.420000 --> 0:10:38.180000
 But going beyond that, review different
 threat intelligence feeds and

0:10:38.180000 --> 0:10:41.600000
 platforms to understand how they contribute
 to proactive threat detection

0:10:41.600000 --> 0:10:44.660000
 and defense, you know, generally
 speaking, how they work.

0:10:44.660000 --> 0:10:48.400000
 So those are my, you know, recommendations
 on next steps for you after

0:10:48.400000 --> 0:10:50.500000
 completing this course.

0:10:50.500000 --> 0:10:53.980000
 And with that being said, that brings
 us to the end of this course.

0:10:53.980000 --> 0:10:58.160000
 It was a wonderful experience for me,
 you know, going through this again.

0:10:58.160000 --> 0:11:00.620000
 And I hope you found value in it.

0:11:00.620000 --> 0:11:03.160000
 But with that being said, that's
 going to be it for this course.

0:11:03.160000 --> 0:11:05.580000
 And I'll be seeing you in the next one.