Understanding Cybersecurity

Understanding Cybersecurity

The Operations of a Security Operations Center (SOC) Team

So, you're interested in cybersecurity but have no idea what it is or how it works? Maybe you're considering starting a career in cybersecurity but don't have any experience and aren't sure where to start. Let me give you a high-level overview to help you understand how a SOC works and the different job roles that exist in a SOC. By the end of this article, you'll have a better idea of where you might fit in and how to get started.

What Happens in a SOC?

Imagine this scenario: an alert pops up in a Security Information and Event Management (SIEM) system, signalling unusual activity on a company's network. This is where the SOC team springs into action.

The Role of the SIEM in SOC Operations

The SIEM is like the command center of a SOC, bringing together data from your entire network, including servers, desktops, security tools and more to give a complete view of the organization. It gathers and analyzes information from:

• Endpoint Detection and Response (EDR): Keeps an eye on computers and devices for any suspicious activity.

• Intrusion Detection Systems (IDS): Monitors network traffic for signs of potential threats.

• Firewalls, antivirus programs, and more.

Alerts and Log Collection

Sometimes, the SIEM pulls alerts directly from these tools when they detect something suspicious. Other times, it continuously collects logs, allowing threat detection engineers to create saved searches. These searches can trigger alerts when certain conditions are met.

Building Saved Searches

Threat detection engineers are key to enhancing the SIEM’s effectiveness. They create and update saved searches based on tactics, techniques and procedures (TTPs) that they often derive from the following:

• MITRE ATT&CK Framework: A detailed guide of hacker tactics and techniques.

• Penetration Tests: Simulated cyberattacks to find security weaknesses.

• Threat Intelligence: Information about new threats and vulnerabilities from various sources.

Responding to Alerts

When an alert is triggered, the SOC team jumps into action to investigate and respond. The team includes several specialized roles:

1. SOC Analysts:

   • Key Skills: Analytical thinking, attention to detail, communication.

   • Alert Triage: They are the first to review alerts from the SIEM, determining which ones need further investigation. A large percentage of these alerts are usually false positives or benign behavior.

   • Requesting Tuning: When an alert is determined to be a false positive, analysts raise a request to the threat detection team to tune the alert and reduce false positives.

   • Escalation: If an alert appears to be a true positive, they escalate it to the incident responders for further action.

2. Security Engineers:

   • Key Skills: Technical knowledge, problem-solving.

   • Tool Management: These experts ensure all security tools are running smoothly and are properly configured.

   • Automation: They develop scripts to automate responses and make processes more efficient.

   • Tool onboarding: The are often in charge of onboarding new data sources to the SIEM.

3. Incident Responders:

   • Key Skills: Quick decision-making, stress management, technical expertise.

   • First Responders: They quickly check the alert to understand its severity.

   • Containment and Eradication: They take steps to isolate the threat and remove it from the network.

4. Threat Hunters:

   • Key Skills: Analytical thinking, creativity, perseverance.

   • Proactive Detection: They actively look for hidden threats that automated systems might miss.

   • Investigations: They use threat intelligence and behavior analysis to uncover complex attacks.

5. Forensic Experts:

   • Key Skills: Attention to detail, investigative mindset, technical expertise.

   • Detailed Analysis: They dig deep into digital evidence to understand the nature of the incident.

   • Root Cause Analysis: They figure out how the breach happened and suggest improvements to prevent it from happening again.

Continuous Improvement

The work of a SOC team is never done. After handling an incident, they review what happened to improve their processes and tools. They work closely with threat detection engineers to update saved searches and enhance their ability to detect threats.

Other Roles in Cybersecurity

Beyond the SOC team, there are many other roles in cybersecurity:

• Penetration Testers (Ethical Hackers):

  • Key Skills: Problem-solving, technical knowledge, creativity.

  • Role: Simulate attacks to identify vulnerabilities before hackers can exploit them.

• Security Architects:

  • Key Skills: Technical knowledge, strategic thinking, project management.

  • Role: Design and implement robust security infrastructures.

• Compliance Officers:

  • Key Skills: Attention to detail, understanding of regulations, communication.

  • Role: Ensure that the organization complies with regulatory requirements and internal policies.

• Vulnerability Management Specialists:

  • Key Skills: Attention to detail, technical knowledge, analytical thinking.

  • Role: Identify, assess, and prioritize vulnerabilities in systems and applications, and coordinate remediation efforts.

• Network Security Engineers:

  • Key Skills: Network architecture knowledge, problem-solving, attention to detail.

  • Role: Design, implement, and manage secure network infrastructures to protect against unauthorized access, modifications, and attacks.

• Others:

  • There are many other areas of Cybersecurity that I have not covered in this blog post such as Cryptography, malware analysis, IAM, and more. These areas are generally more specialised and are often entire departments outside of the SOC.

Conclusion

A SOC team is crucial for defending against cyber threats, using a range of tools and expertise to protect an organization’s digital assets. From the moment an alert appears in the SIEM, a well-coordinated response involving multiple specialized roles ensures that threats are swiftly identified and mitigated. If you're considering a career in cybersecurity but don't have any experience, starting as a SOC analyst is a great place to begin. As a SOC analyst, you will learn about all the various security tools in your company, what makes a good alert and also how to respond. Once you’ve gained this knowledge, it should allow you to make a more informed decision on what road to follow thereafter.

Are you interested in starting your own newsletter?

Beehiiv is an amazing platform and is what I used for this post, feel free to support me by signing up using my affilate link here: https://www.beehiiv.com?via=the-itscybernews-team