Tags: #◇Computer Science #◇NSSECU1 #◇Conceptual #◇Defensive Security #◇SOC
◇Overview
Defensive security focuses on maintaining a robust security posture to prevent, detect, and respond to cyber threats. The Security Operations Center (SOC) is the centralized function within an organization responsible for continuously monitoring and analyzing security posture.
◇Key Definitions
- SOC (Security Operations Center): A centralized team and facility responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents.
- SIEM (Security Information and Event Management): Software that aggregates and analyzes activity from many different resources across an IT infrastructure.
- Incident Response (IR): A structured approach to handling cybersecurity breaches or incidents.
- Threat Hunting: Proactively searching through networks to detect and isolate advanced threats that evade existing security solutions.
◇Theoretical Framework / Core Concepts
SOC Functions and Tiers
- Tier 1 (Triage/Alert Analysis): Monitors SIEM alerts, performs initial triage, and escalates true positives.
- Tier 2 (Incident Response): Deep-dive analysis of escalated incidents, containment, and eradication planning.
- Tier 3 (Threat Hunting/Malware Analysis): Proactive hunting, reverse engineering, and advanced forensics.
NIST Incident Response Lifecycle
- Preparation: Establishing policies, tools, and training before an incident occurs.
- Detection & Analysis: Identifying signs of an incident and determining its scope and severity.
- Containment, Eradication, & Recovery: Stopping the spread, removing the threat, and restoring systems.
- Post-Incident Activity (Lessons Learned): Documenting what happened and improving processes.
◇Worked Examples / Protocol Walkthroughs / Calculations
SIEM Alert Triage Workflow
- Alert Generation: SIEM flags "Multiple Failed Logins from IP 203.0.113.5".
- Enrichment: Tier 1 analyst checks Threat Intelligence feeds; IP is known for SSH brute-forcing.
- Validation: Analyst checks server logs to see if a successful login followed the failures.
- Escalation/Action: If no successful login, block IP at firewall. If successful, escalate to Tier 2 for compromised account containment.
◇Summary & Key Takeaways
- The SOC is the heart of an organization's defensive capabilities, relying heavily on SIEM technology.
- Effective Incident Response is cyclical and emphasizes Preparation and Lessons Learned.
- Defensive security requires a shift from purely reactive alert-handling to proactive threat hunting.
◇References & Navigation
- Previous Topic: ◇Vulnerability Assessment and Penetration Testing
- Next Topic: ◇Capture the Flag and Applied Security
- Related Notes: ◇Cybersecurity Awareness, ◇Security
ACTIVE RECALL VERIFICATION
Select an answer to verify conceptual comprehension and reveal the technical rationale.
What is the primary function of a Security Operations Center (SOC)?
Which technology is central to a SOC for aggregating and analyzing log data?
In a typical SOC hierarchy, which tier is responsible for initial alert triage?
Proactively searching networks for threats that bypass standard security controls is called:
According to the NIST Incident Response lifecycle, what is the first phase?
Which phase of IR involves isolating a compromised host from the network?
What is an Indicator of Compromise (IoC)?
After resolving a major security incident, the team holds a meeting to discuss what went wrong and how to improve. Which phase is this?
What does SOAR stand for in the context of modern SOC operations?
A SOC analyst receives an alert for a known malware hash. Which system most likely generated this specific alert?