SOC

Are we leading by example?

It was a great week leading the RSA Conference Security Operations Center (SOC) Team consisting of RSA systems engineers, RSA Incident Response analysts and our partners at Cisco AMP Threat Grid. The Security Operations Center previously monitored the Black Hat conference network, but this was a first-time exhibit at RSA Conference. The team signed onto…

A View From the #RSAC SOC – Part 2

In today’s world, cameras are just about everywhere – in stores, on the streets, inside of cars, and many other locations.   Now, imagine you are a bank employee and your bank had no cameras – would you feel secure?   Probably not.   The reality is that many organizations have no “security cameras” on their networks to…

Launching the Security Operations Center (SOC) at RSA Conference

Welcome to RSA Conference 2017! The RSA Conference SOC team set up the Security Operations Center over the weekend. We were here along with scores of construction crews re building huge booth displays for some of the largest security companies in the world. It was a long weekend of building, lighting – and of course…

Mastering the implementation of a Threat Pattern

In previous posts we have discussed two of the most critical phases in the “The Lifecycle of a Threat Pattern”: analysis and design. In the analysis phase the objective is to fully understand the asset in scope by getting deeper into the context to formulate a set of residual risks to which the asset might be…

Engineering The Design Of A Threat Pattern

In our journey of developing and maintaining threat patterns, we have now arrived at a critical phase: the design. While the need of an implementation phase is immediate as well as the evaluation of the background analysis in order to build something meaningful (as explained by my colleague, Demetrio Milea) – the intermediate design phase is the…

Revisiting the SOC Structure

Building and maintaining skill sets and expertise in a SOC is a difficult task – and many security leaders face this challenge. They are not able to retain best of the talent for long term. There are too many tools for them to invest in,,, too many alerts that pop up when the tools are…

The Life Cycle of a Threat Pattern

Applying a structured approach to developing and maintaining significant threat patterns is absolutely key to successfully hunting for the advanced TTPs used by many motivated threat actors. In the post, Context in Risk-Based Threat Patterns, author Demetrio Milea suggested a simple and effective method borrowed from the Software Development Life Cycle (SDLC) to design and maintain threat patterns…

Building rockstars in SOC

What makes detection most effective? I know you are thinking technology. However, if you have been in the security operations domain for long, you know the answer. It’s the “people” who use the technology. As a infosec leader/member for your organisation, you should continuously look for methods and tools that make your teams better and…

Measure your Readiness – Threat Intelligence Program

In the first part of this series we talked about the journey to undertake building a security monitoring and incident response program based on five dimensions: analytics, governance, measurement, operational and organizational. The third main program, also considered a primary capability of an effective Security Operations Center, is the development of tactical, operational and strategic…

Measure your Readiness – Security Monitoring Program

In the previous post of this series “Measure your Readiness”, I depicted a framework to assess, shape and accelerate a Threat-Driven Incident Response program useful for all kind of organizations to enhance their response capabilities and be ready to deal with unforeseen incidents. The second post in the series aims to look at the “security…