SOC Fundamentals

Presented by Salman Qureshi

Security Operations Center
 A dedicated unit is established by the organizations to handle and manage their security operations,
known as Security Operation Center (SOC)

 It is centralized unit that continuously monitors and analyzes ongoing activities on an organization’s
information systems such as networks, servers, endpoints, databases, applications, websites, etc.
Need of SOC
Organizations use various security measures such as intrusion detection/prevention system, firewall,
email filtering, URL filtering, and antivirus to protect the organization's network from threats.

However, in recent times, these security measures proved insufficient to provide enough security as
hackers are inventing new trends and techniques to penetrate the network by evading such security
measures. So, the need for such security measures that can keep the security perimeter always
updated regarding new and developing threats and vulnerabilities. This is possible through SOC.

SOC is responsible for performing the following types of activities:

 Proactively identifying suspicious activities in the network and system.

 Performing vulnerability management to identify which activities are vulnerable to the network.
 Getting aware of hardware and software assets working in the network.
 Performing log management that facilitates forensics at the time of security breaches.
 Red, Blue and Purple teaming activities
 Threat Hunting
 Eradicating internal blinders.
SOC Essential Functions
 Network Security Monitoring

 Incident Response

 Forensics

 Command Center

 Threat Intelligence

 Self Assessment
SOC Capabilities
 SOC Workflow

INCIDENT RESPONSE FEEDBACK LOOP

COLLECT INGEST VALIDATE REPORT RESPOND DOCUMENT

•Log data are •Threat data, •SOC analysts •Validated •IRT Team •Document
collected from flow data, and look for incidents are reviews incident for
various other indicators of then escalated incidents and business audit
devices on the contextual compromise to the performs purposes and
network and data along (IoC), triage response incident lesson learned
sent it to the with log data the alerts, and teams through response
SIEM are ingested validate ticketing activities
into SIEM for incidents system
event
correlation
and
identification
of anomalous
activity
 Security Dataflow

DATA TYPES/DATA SOURCES MODULES VIEWS

Firewall
Data Ingestion Process
Alerting
Database

Endpoint
Reporting
WWW
NORMALIZATION

CORRELATION
COLLECTION

DATABASE
INDEXING

File Server
Query
Email
Security
Management Server
Archiving
Operation
Center (SOC)
Routers

Switches Data Ingestion Process Workflow

IPS/IDS
Components of SOC: PP&T
A SOC requires cooperation and communication among People (Analyst, Operators, Administrators, Engineers, etc.) who
monitor and analyze an organization’s IT infrastructure using the combination of Processes, Procedures, and Technology

Skilled people for defined processes should have proper knowledge of intelligence technologies

Processes that are planned according to the technology should act as a connection between people and technology. They
should ensure that both people and technology are operating adequately
Components of SOC: People
• People are specialized individuals working at different levels of SOC
1
• They should have deep technical knowledge, a wide range of capabilities, and a variety of experiences
2
• They should be able to monitor and analyze a large amount of data/information that can be used for further investigations
3
• They should possess the necessary training and certifications required to fulfill their respective roles and responsibilities
4

CISO

SOC Manager

Subject Matter Expert

L1:SOC Analyst L2: SOC Analyst Incident Responder SIEM Engineer
/ Hunter
Components of SOC: Processes
• Processes are used by the different functional parts of the SOC to perform seamless and effective operations
• They behave as a link between people and technology
• The right team performs the right tasks through a well-defined process

01 Business Processes 02 Technology Processes

• In the processes, administrative components are • In these processes, actions related to IT infrastructure
defined and documented for the efficient functioning is defined and documented
of SOC • They ensure that IT infrastructure will works at best
• They position the operations as per the organizational levels at any particular time
objectives • Examples: Vulnerability scanning and remediation,
• Examples: report preparation, log retention, etc. firmware, etc.

03 Operational Processes 04 Analytical Processes

• Analytical processes explain the way to detect and

remediate security issues
• These processes describe the different activities that • They include different methods of identifying and
are performed in a SOC understanding surfacing threats
• Examples: incident classification, detection and
• Examples: Shift scheduling, Employee training escalation, ticketing and forensics
Components of SOC: Technology

The organization should always select that technology that works for people and processes

The technology used in SOC should be collaborated efficiently to secure systems and networks

Technology

Security Automated
SIEM Solutions Dashboard Ticketing System
Monitoring Tools Assessment Tool
Types of SOC Models
The selection of a specific type of SOC model depends upon the requirements, processes, and day to
day functionalities of an organization.

Three different types of SOC Models

1 In-House / Internal SOC Model

2 Outsourced SOC Model / SOC as a Service

3 Hybrid SOC Model

Types of SOC Models – In-House
 An in-house / internal SOC model is recommended to those organizations that have security issues
related to outsourcing
 Outsourcing affects the integrity and functionality of the business

 Advantages:-
 It helps the in-house staff to understand the organization and its environment in a much better manner, as compared to
the third-party security service provider
 It provides a complete picture related to the security posture of an organization

 Disadvantages:-
 This model takes many years to set up infrastructure, threat intelligence, and other capabilities
 It requires huge advance investment
Types of SOC Models - Outsourced
 It provides a robust security solution to the organization
 In this model, Managed Security Service Provider (MSSP) sets up the infrastructure and offers SOC
monitoring and other capabilities
 It has a dedicated team of trained and experienced security analysts, who can monitor and analyze
incidents, respond processes, aggregate technologies, correlate and analyze data, and perform
threat research and intelligence on an ongoing basis

 Advantages:-
 This model also helps the organization to meet specific compliance requirements
 It offers cost-effective services as compared to in-house SOC model
 It takes less time to build this model at an efficient level

 Disadvantages:-
 It has the risk of external data mishandling
 It does not provide long-term gain to the company
Types of SOC Models - Hybrid
 It is a combination of both in-house and outsourced SOC Model
 In this model, the organization is accompanied with MSSP to offer the most secure approach

 Advantages:-
 They share synergies for technology, processes, expertise, facilitates, and personnel to reduce the cost
 This model provides the best approach for monitoring and analyzing intrusion incidents, quick detection and response
time, and low backlogs

 Disadvantages:-
 It sets up extra hardware, managing data / information by the third party
 It is expensive for long-term duration
SOC Maturity Models

Maturity models are IT governance tools that explain the organization’s working as per standardization,
results, and measurement of effectiveness

They are used to analyze where a SOC succeeds and where it requires improvements

Few examples of maturity models include Control Objectives for Information Technology (CoBIT), Software
Capability Maturity Model (CMMI), etc.

Types of Maturity Models:

SOC-Capability Maturity Control Objectives for National Institute of System Security
01

02

03

04
Model Information Technology Standards and Engineering Capability
(CoBIT) Technology (NIST) Maturity Model (SSE-
Cybersecurity CMM)
framework
SOC Implementation

Planning Designing & Building the SOC

• Initial assessment is done based on existing capabilities

with respect to people, processes, technology, • Designing and building phases of SOC are almost linked
business, and IT objectives to each other
• SOC strategy development is carried out by considering • Selection of the best technology to implement efficient
its strategic goal, scope, model, services, KPI, metrics, SOC is carried out in this phase
etc.

Operating the SOC Reviewing & Reporting the SOC

• SOC is moved from the building phase to the operating • Review the SOC to identify the areas of improvement
phase with the help of a proper transition plan and to check whether it is operating accordingly
Challenges in SOC Implementation

Processes and procedures formalization,

1 Increasing the volume of security alerts 6 orchestration, and automation

2 Management of numerous security tools 7 Data integrity and intelligence management

3 Lack of skilled analysts 8 Handling multi-staged advanced attacks

4 Legal and regulatory compliance 9 Rapid change in technology and security

5 Technology selection and configuration 10 Continuous training

SIEM Solutions
 Splunk
 IBM Qradar
 LogRhythm
 HP ArcSeight
 McAfee
 ClearSkies
 AlientVault
 SolarWinds
SOC Certifications
 Vendor Specific
 Qradar
 Splunk
 LogRhythm
 HP ArcSeight

 Non-vender (Neutral)
 Cysa+
 GCIH
 GMON
 EC Council CSA
Thanks !!!