Level up your SOC - Guide for a Resilient Education Program.pdf

1. Level Up Your SOC: Guide for a Resilient Education Program National Cyber Summit Brandon DeVault Principal Security Author, Pluralsight Defensive Cyber Operations, Air National Guard /in/brandon-devault @SolderSwag www.devaultsecurity.com

2. OUTCOMES! How to assess your team and adversary How to build a sustainable education plan How to upgrade training to meet advanced actor capabilities

3. CLARIFICATION

4. AGENDA 1. Assessing the Adversary 2. Assessing the Defender 3. Defining Clear Roles 4. Creating the Plan 5. Tackling APTs

5. YOUR ADVERSARY SETS THE STANDARD

6. CAPABILITIES Lone Wolf Hackers Hacktivists Organized Crime APT Groups

7. RISK ANALYSIS Cost vs. Skills Lone Wolf Hackers Hacktivists Organized Crime APT Groups

8. ASSESSING THE DEFENDER

9. IMPLIED KNOWLEDGE • Do you know what these things are?

10. SKILL IQ

11. DEFINING CLEAR ROLES

13. CYBER CRIME INVESTIGATOR WORK ROLE ID: 221 • “Knowledge of processes for seizing and preserving digital evidence (e.g., chain of custody).” • “Fuse computer network attack analyses with criminal and counterintelligence investigations and operations.” • “Assess the behavior of the individual victim, witness, or suspect as it relates to the investigation.” • “Provide criminal investigative support to trial counsel during the judicial process.”

14. DCWF ROLES Cyber Defense Analyst Cyber Defense Incident Responder Cyber Defense Threat Hunter • Knowledge of the common attack vectors on the network layer. • Skill in performing packet level analysis. • Identify and analyze anomalies in network traffic using metadata. • Knowledge of malware analysis concepts and methodologies. • Skill of identifying, capturing, containing, and reporting malware. • Perform cyber defense trend analysis and reporting. ?

15. CASE STUDY Current Roles

16. Intel Identify Protect Detect Respond Recover Emulate

17. Incident Responder SOC Analyst Threat Hunter Red Team Operator Forensic Analyst Security Architect Security Engineer Malware Analyst Exploit Developer Threat Intel Analyst Risk & Governance Manager Compliance Manager IT Auditor Architecture & Engineering Security Operations Governance, Risk & Compliance Penetration Tester Web App Penetration Tester Vulnerability Analyst Pluralsight Security Role Framework

18. Core Skill Incident Response Product/Tool Skills IBM Security QRadar Elastic Security Network Security Monitoring with Suricata Supplemental Skills Python for Cyber Defense Advanced Continuous Learning Breaking News: Vulns, Exploits and Breaches Relevant Certification Preparation Cisco Certified CyberOps Associate CompTIA Cybersecurity Analyst (CySA+) Malware: Prevention, Detection, and Response Network Attacks & Threats with Wireshark Blue Team Tools Incident Responder SOC Analyst Threat Hunter Red Team Operator Forensic Analyst Security Architect Security Engineer Malware Analyst Exploit Developer Threat Intel Analyst Risk & Governance Manager Compliance Manager IT Auditor Architecture & Engineering Security Operations Governance, Risk & Compliance Penetration Tester Web App Penetration Tester Vulnerability Analyst Role-Centric Skill Development

19. Core Skill Incident Response Product/Tool Skills IBM Security QRadar Elastic Security Network Security Monitoring with Suricata Supplemental Skills Python for Cyber Defense Advanced Continuous Learning Breaking News: Vulns, Exploits and Breaches Relevant Certification Preparation Cisco Certified CyberOps Associate CompTIA Cybersecurity Analyst (CySA+) PowerShell for Cyber Defense Network Attacks & Threats with Wireshark Blue Team Tools Incident Responder SOC Analyst Threat Hunter Red Team Operator Forensic Analyst Security Architect Security Engineer Malware Analyst Exploit Developer Threat Intel Analyst Risk & Governance Manager Compliance Manager IT Auditor Architecture & Engineering Security Operations Governance, Risk & Compliance Penetration Tester Web App Penetration Tester Vulnerability Analyst Role-Centric Skill Development

26. THE EDUCATION PLAN

27. CREATE A LEVEL UP APPROACH

28. THE PLAN (AN APPROACH) Initial Skills Training (IST) • Fundamentals / Theory Initial Qualification Training (IQT) • Using the tools Mission Qualification Training (MQT) • Mission specific (environment) Continuation Training • Research,Workshops, and Conferences

29. CONSIDERATIONS Assess potential Vendors Sustainable budget Time commitment Ask your people!

30. ADVANCED PERSISTENT THREATS

31. REACTIVE VS. PROACTIVE SECURITY Reactive • Security Analytics • Incident Response • Intrusion Detection Systems (IDS) • Anti-virus / Anti-malware Proactive • Threat Hunting • Threat Emulation • Pen-testing

32. Intel Identify Protect Detect Respond Recover Emulate

33. MITRE ATT&CK

35. TECHNIQUES USED

36. TECHNIQUES USED

39. QUESTIONS? • www.devaultsecurity.com • linkedin. • twitter. devaultsecurity.com • github. • brandon-devault@pluralsight.com • https://app.pluralsight.com/profile/author/brandon-devault }

Level up your SOC - Guide for a Resilient Education Program.pdf

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Level up your SOC - Guide for a Resilient Education Program.pdf

Similaire à Level up your SOC - Guide for a Resilient Education Program.pdf (20)

Plus de Brandon DeVault

Plus de Brandon DeVault (13)

Dernier

Dernier (20)

Level up your SOC - Guide for a Resilient Education Program.pdf