How to organise Cyber Security Operations Center - CSOC?

Igor Hitrec(ISC)2 Adriatic Chapter Meeting 20.May 2021

SOC Manager @beIN.COM» Miramax, Digiturk, USA, France, UK, Singapore, Australia, Qatar

www.linkedin.com/in/igorhitrec-cybersecuritymanager

whoami

Why we need CSOC?

SOC, CSOC, GSOC…

Why?

To consolidate and centralize defense and response capabilities and support business/function/….

Components of CSOC» To protect

• Business

» we need• People• Technology• Processes

» by providing• (X)SOC Services

Business part» Business drivers» Customers» Privacy» Governance» Charter Document

Business part» Information security management system» Risk assessment» Risk management» Incident management -> Service Level Agreement» Deployed security controls

CSOC Strategy – MITRE 10 commandments1. Consolidate computer and network defense under one organization2. Achieve Balance Between Size3. Give SOC Authority to Do its Job4. Do a Few Things Well5. Favour Staff Quality over Quantity6. Maximize the Value of Technology Purchases7. Exercise Discrimination in the Data You Gather8. Protect the SOC Mission9. Be a sophisticated Consumer and Producer of Cyber Threat Intelligence10. Stop. Think. Respond... Calmly

CSOC Operating Models - GartnerSOC Model Attributes Typical Adopter

Virtual SOC

• No dedicated facilityPart-time team membersReactive, activated when a critical alert or incident occursPrimary model when fully delegated to MSSP

SMBs, small enterprises

MultifunctionSOC/NOC

• Dedicated facility with a dedicated team performing not just security, but someother critical 24/7 IT operations from the same facility to reduce costs

Small, midsize and low-risk large enterprises where network and security functions are

already performed by the same or an overlapping group of people and teams

Distributed/Co-managed SOC

• Dedicated and semi dedicated team membersTypically, 5x8 operationsWhen used with an MSSP it is co-managed Small and midsize enterprises

Dedicated SOC

• Dedicated facilityDedicated teamFully in-house24/7 operations

Large enterprises, service providers, high risk organizations

Command SOC

• Coordinates other SOCsProvides threat intelligence, situational awareness and additional expertiseRarely directly involved in day—to-day operations Very large enterprises and service providers;

governments, military, intelligence

CSOC example of operation model

SOC manpower sizing

Estimations alerts/day

Year 1minutes/incident

(SLA!) Hours/day People 3 shifts 24/7

For T1 analysts 100 20 33,3 4,16 2 per shift, overal 8

For T2 analysts 30 60 30 3,75 1 per shift, overal 4

For T3 analysts 3 240 12 1,52 for redundancy with extra

working time

SOC manpower sizing» SOC Administrator» Threat Intelligence» Threat Hunt» Reporting, metrics, analytics

SOC manpower - competencesJob position in SOC Function Courses and certification

T1 AnalystT2 AnalystT3 Analyst Threat analysis

GIAC Security Essentials (GSEC)EC-COUNCIL Certified incident handlerGIAC Certifified Incident Handler (GCIH)(ISC)2 CISSP Certified Information Systems Security Professional

T2 AnalystT3 AnalystSOC Manager

Incident managementISO/IEC 27035 Lead Incident Manager

SOC ManagerCSIRT-CERT

ISO/IEC 27035 Lead Incident Manager,ISACA CISM Certified Information Security Manager,(ISC)2 CISSP Certified Information Systems Security Professional

T2 AnalystT3 Analyst Incident response GIAC Cyber Threat Intelligence (GCTI),

EC-COUNCIL Certified Ethical HackerSOC AdministratorT2 AnalystT3 Analyst Case studies

EC-COUNCIL Certified Ethical Hacker,SANS FOR578: Cyber Threat Intelligence, GIAC Cyber Threat Intelligence (GCTI)GIAC Response and Industrial Defense (GRID)

T3 AnalystThreat Intelligence

SANS FOR578: Cyber Threat Intelligence, GIAC Cyber Threat Intelligence (GCTI)

T3 AnalystForensic analysis

SANS FOR508: Advanced Incident Response, Threat Hunting and Digital Forensics,GIAC Certified Forensic Analyst (GCFA)GIAC Response and Industrial Defense (GRID)

T3 Analyst Reporting Solution provider trainings

T3 Analyst Analitics GIAC Certified Forensic Analyst (GCFA)ARCITURA Big Data Science Certified Professional (BDSCP)

SOC AdministratorT3 Analyst SOC Administration Solution provider trainings

SOC AdministratorT3 Analyst

Log source management

Microsoft MTA, Microsoft MCSE, LPI Linux Enterprise Professional – SecurityGIAC Global Industrial Cyber Security Professional (GICSP)

SOC AdministratorT3 Analyst SOC Integrations Solution provider trainings

SOC Technologies

SOC Tools» SIEM – Security Information and Event Management

Collecting logs and netflow, Offense library, Use Case builder, Dashboards, Alerting, Reports…

» SOAR - Security Orchestration, Automation, and ResponseManaging incident response playbooks, escalation matrix, ticketing service, KPI dashboards, alerting, reporting, capability for automated response…

» Threat Intelligence Platform receiving various threat feeds, scoring capabilities, build your own threat feed and sending it to your SIEM, SOAR and other controls…

» Big Data infrastructure

SOC and security controls

MS Windows infrastructure integration

» MS Windows Events to watch• https://www.microsoft.com/en-us/download/details.aspx?id=52630• https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--

events-to-monitor• https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-

practices/monitoring-active-directory-for-signs-of-compromise

MS Windows infrastructure integration

» Monitor PowerShell Events§ Heavily used by attackers§ Powershell v.5 (latest is 7.1.3) is the minimum recommended version for enhanced logging

capabilities§ No Powershell audit is enabled by default§ 501: Powershell Execution§ 4103: Module logging§ 4104: Powershell Scriptblock module loading

MS Windows infrastructure integration

» Windows Registry Persistence Monitoring§ https://www.cyborgsecurity.com/cyborg_labs/hunting-for-persistence-registry-run-keys-startup-

folder/

MS Windows infrastructure integration

» SYSMON• Free tool from Microsoft• No performance issues• Around 3 EPS per machine [Depends on configuration]• Provide massive visibility • Extra logging features for Windows:

• Loaded drivers• Logs process creation with full command line for both current and parent processes• Records the hash of process image files• DLL Injection [CreateRemoteThread]• Include a session GUID in each events to allow correlation of events on same logon session• Optionally logs network connections, including each connection’s source process, IP addresses, port numbers, hostnames and port

names.

• SYMON CONFIGURATION FILE• https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml

MS Windows infrastructure integration

» Windows Event Forwarding• Windows Event Forwarding (WEF) reads any operational or administrative event log on

Windows devices and forwards the events you choose to a Windows Event Collector (WEC) server.

• WEF subscription to be configured to Push logs to WEC server • The WEF client machines local event log is the buffer for WEF for when the connection

to the WEC server is lost. Maximum file size is configurable• Events can be sent to multiple Collectors (optional for high availability)• End Point logs to be forwarded to a dedicated WEF server for endpoint

• https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection

Use Cases Framework - MaGMa» Used by Dutch financial institutions» MaGMa Use Case Framework (UCF) is a framework

and tool for use case management and administration that helps organizations to operationalize their security monitoring strategy

» https://www.betaalvereniging.nl/en/safety/magma/

Use Cases Framework - MaGMa

Use Cases Framework - SPEED» Splunk, QRadar, ArcSight, ELK Elastalert

» http://correlatedsecurity.com/introducing-speed-use-case-framework-v1-0/

» https://github.com/correlatedsecurity/SPEED-SIEM-Use-Case-Framework

Use Cases Framework - SPEED

Use Cases for MS Windows Infrastructure» SYSMON MODULAR (MITRE ATT@ACK FW mapping)

https://github.com/olafhartong/sysmon-modular» Atomic Red Team (MITRE ATT@ACK FW mapping)

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.001/T1078.001.md

» Red Team Automation (MITRE ATT@ACK FW mapping)https://github.com/endgameinc/RTA

SOC Processes

Security Intelligence

Threat Hunting

Use Case/Rules

Release &Deployment

Tier 1/2Threat Monitoring

& Triage

Tier 3Incident Response

Lessons Learned

Log Source/Contextual

Data

T3 - Response IntelligenceSOC Manager IT or OTT1/2 – Monitoring & Triage SOC AdminCSIRT

SECURITY INTELLIGENCE SERVICES SOC BUILD SERVICES

SOC RUN SERVICESCrisis Management

ForensicsInvestigation

Fraud/HR

Remediation

ReportingManagement

Security ControlUpdate

ITIL PROCESSES (Reference only)

ConfigurationManagement

ChangeManagement

ProblemManagement

Analytics

CSIRT

Security Intelligence Services» Security Intelligence (Threat Intel (TI) Analyst)

• Process + Threat Intel platform• Reviewing feed input, checking applicability, building internal treat

feed, cooperation with Tx’s in tuning controls and building use cases

» Use Case Management (TI Analyst and Tx’s)• Working upon Threat Intel and Tx’s input, testing and

putting in production» Security Control Update (IT Department)

• Usually with IT, following ITIL change management, SOC should monitor and be informed

Security Intelligence Services» Threat Hunting (T3)

• Input from Threat Intel, Input from Case Studies• Planned and approved activity• Should use all available tools• Metodology TaHiTI

https://www.betaalvereniging.nl/en/safety/tahiti

SOC Build Services» Log sources and contextual data (SOC Admin)

• RegEX Njinja• Constant monitoring and maintaining quality of log sources

» Release and Deployment (TI Analyst and SOC Admin)• Working with IT, upgrading configurations, updating Use

Cases, SOAR playbooks management

SOC Run Services» Monitoring and triaging incidents (Tx’s)

• As per playbooks: Initial phase, identification containment, eradication, recovery, lesson learned

• Escalation, Automation

» Incident Response (T3)• In case of serious incidents who might lead to damage and

interruption

» CSIRT (T3, SOC Manager, CISO…)• Confirmed serious incident, escalation…

SOC Run Services» Lessons Learned

• To formalize need for necessary improvements after incident• To improve current controls, measure SOC effectiveness, start new

strategic initiative

» Crisis Management» Forensic Investigation» Remediation & Disaster Recovery

SOC Metrics» SOC-CMM Model» 5 domains, 25 aspects

» https://www.soc-cmm.com/

SOC Metrics

SOC Metrics

SOC Risks (Gartner)» Breach Response Failures» Skills, Expertise and Staff Retention» Demonstrating a Return on Investment

SOC Alternatives» Informal SOC» Outsources SOC (MSSP)

Recommendations» If money is short -> keep high business value and critical security functions

in-house (architecture design, GRC management, analytics and incident response);

» Outsource to MSSP easier tasks, it might be cheaper and should provide additional eyes to monitoring and help during security incidents, weekends and holidays;

» Develop tightly defined goals first (Strategy!) and clear metrics for SOC needs to deliver;

» Secure budget for 2-3 years for SOC – this amount of time is usually required for people/processes/technology to achieve proper maturity and efficiency.

»The End