Document Resources

SOC Class Functional Area Swimlane Overall 2016 07 16
Montance Resource Google Drive
SOC Class Functional Area Swimlane Overall 2016 07 16
Montance Resource Google Drive
SOC Class Functional Area Swimlane Overall 2016 07 16
Montance Resource Google Drive
SOC Class Functional Area Swimlane Overall 2016 07 16 Old
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Montance Resource Google Drive
IR Scenarios General Duplicate
Montance Resource Google Drive
Cultural Dimensions Hofstedeocs Pro Demo Report
Montance Resource Google Drive
Cybertab My Report 06 26 2016
Montance Resource Google Drive
Cybertab Worksheet
Montance Resource Google Drive
Damien Paul Links
Montance Resource Google Drive
Damien Paul Books
Montance Resource Google Drive
CSAguide V3.0
Montance Resource Google Drive
Common Technology Opensource Mod Enterprise 2021 04 20
Montance Resource Google Drive
Technology Taxonomy
Montance Resource Google Drive
Analyst Baseball Card Crowley
Montance Resource Google Drive
MGT517 Links 3
Montance Resource Google Drive
MGT517 Links 2
Montance Resource Google Drive
MGT517 Links 5
Montance Resource Google Drive
MGT517 Links 1
Montance Resource Google Drive
MGT517 Links 4
Montance Resource Google Drive
Cyber Security Resources V20190605
Montance Resource Google Drive
Secureworks The Total Economic Impact Of MSS
Montance Resource Google Drive
Sans RSA Building World Class SOC Roadmap
Montance Resource Google Drive
HP State Of Security Operations 2015
Montance Resource Google Drive
Sans Six Things You Need To Consider Before Buying A Log Management Tool
Montance Resource Google Drive
Splunk APT Tech Brief
Montance Resource Google Drive
Sans Top5logreports Extended
Montance Resource Google Drive
Sans SIEM Methodology
Montance Resource Google Drive
Sans Capability Maturity Model Derive Security Requirements 1005
Montance Resource Google Drive
Sans Log Review Maturity
Montance Resource Google Drive
HP Building Maturing And Rocking A SOC
Montance Resource Google Drive
Nsa Windows Event Log Monitoring
Montance Resource Google Drive
RSA SOC Ops Analysis & Design Service
Montance Resource Google Drive
NIST Sp800 137 Final
Montance Resource Google Drive
McAfee SOC Creating Maintaining SOC
Montance Resource Google Drive
MGT517 Course Flyer
Montance Resource Google Drive
APAC SOC Summit Survey
Montance Resource Google Drive
SOC Metrics For First
Montance Resource Google Drive
Technology Taxonomy Crowley Pescatore
Montance Resource Google Drive
SOAR Austin
Montance Resource Google Drive
Cybersecurity Operations Today
Montance Resource Google Drive
2026 SANS SOC Survey Insights: A Decade of Evolution in Cyber Defense
Montance Resource Google Drive
Using MITRE ATT&CK® as an Operational Framework
Montance Resource Google Drive
Integrating AI/ML into SOC Detection Engineering: Building Smarter, Faster Defenses
Montance Resource Google Drive
Integrating AI/ML into SOC Detection Engineering: Building Smarter, Faster Defenses
Montance Resource Google Drive
Integrating AI/ML into Security Operations
Montance Resource
The Value of Cybersecurity Operations
Montance Resource Google Drive
2026 SOC Survey Jupyterlab and DEIDENT Response Release
Montance Resource Google Drive
AI/ML Defend and Attack
Montance Resource Google Drive
Reengineering the SOC: A Roadmap to AI-Enhanced Cyber Defense
Montance Resource Google Drive
SANS San Francisco 2026 - SANS@Night: 2026 SOC Survey Review
Montance Resource Google Drive
SANS Riyadh AI & Cloud Security 2026: Integrating AI/ML into SOC Detection Engineering: Building Smarter, Faster Defenses
Montance Resource Google Drive
The Value of... Webcast Series. Chapter 1
Montance Resource Google Drive
The Value of... Webcast Series. Chapter 2
Montance Resource Google Drive
Proving the value of security operations with Christopher Crowley (Episode 344)
Montance Resource Google Drive
Methodologies for Analysis (with Christopher Crowley) - CISO Tradecraft
Montance Resource Google Drive
Measuring The Value of SecOps - Enterprise Security Weekly
Montance Resource Google Drive
Reengineering the SOC: A roadmap to AI-enhanced cyber defense
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What does 'Weltanschauung' mean in the context of this slide?
A: It refers to the 'collective programming of the mind' or worldview that affects communication and operations.
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What is the 'Means-Oriented' vs. 'Goal-Oriented' dimension?
A: A cultural dimension describing whether an organization focuses on *how* work is done (process) or *what* is achieved (results).
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What characterizes an 'Internally Driven' culture?
A: Employees perceive their task towards the outside world as a given, often considering themselves experts who know what is best for the customer.
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What characterizes an 'Externally Driven' culture?
A: The emphasis is on meeting the customer's requirements; results are more important than procedures.
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What is 'Easygoing' vs. 'Strict' work discipline?
A: Refers to the amount of internal control and discipline; strict cultures are cost-conscious and punctual, while easygoing ones are more fluid.
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What is the 'Local' vs. 'Professional' dimension?
A: Local employees identify with the boss/unit; Professionals identify with their profession and content of work.
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What defines an 'Open System' culture?
A: Newcomers are made immediately welcome, and people are open to outsiders.
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What defines a 'Closed System' culture?
A: The organization is secretive, and only 'insiders' are trusted.
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What is 'Employee-Oriented' vs. 'Work-Oriented'?
A: Employee-oriented feels a responsibility for employee welfare; Work-oriented pressures for performance even at the expense of employees.
Montance Resource Google Drive
Cultural Dimensions Slide
Q: What is 'High Acceptance' vs. 'Low Acceptance' leadership style?
A: Refers to the leadership style of the boss; high acceptance means the style is aligned with staff preferences.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What was the sample size for the 2017 APAC SOC Summit Survey?
A: 298 respondents.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What were the top two industries represented in the survey?
A: Cyber Security (21%) and Banking/Finance (19%).
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What percentage of respondents listed their headquarters in the US?
A: 54%.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What is the most common SOC size for businesses under 10,000 employees?
A: 5 people or less.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What percentage of organizations reported using NIDS/NIPS?
A: 91%.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What percentage reported using Application Whitelisting?
A: 66%.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What percentage of organizations have NO Network Operations Center (NOC)?
A: 22%.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What is the most commonly outsourced SOC component?
A: Threat Research (44%).
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What percentage of respondents outsource Digital Forensics?
A: 38%.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What percentage of Banking and Finance respondents handle Forensics entirely in-house?
A: Approximately 37% (14 out of 38 respondents).
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What industry is least likely to outsource Forensics?
A: Retail (only ~9% outsource).
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What percentage of respondents use a SIEM for correlation?
A: 77%.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What percentage of organizations have metrics that are primarily automated?
A: 40%.
Montance Resource Google Drive
2017 09 20 APAC SOC Summit Survey
Q: What was the top 'Wishlist' item for 2018?
A: More automation and orchestration tools.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: What specific tools did the author use for post-exploitation?
A: Busybox, nmap, Responder.py, Python, tcpdump, dsniff, socat, screen, a SOCKS proxy server, and tgcd.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: How did the attacker initially gain access to Hacking Team?
A: By exploiting a 0day vulnerability in an embedded device (spam filtering appliance/VPN) after finding it via port scanning.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: What is 'Responder.py' used for?
A: Attacking Windows networks to capture credentials/hashes via LLMNR/NBT-NS poisoning when you have internal access but no domain user.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: How did the attacker access the 'Rete Sviluppo' (Development Network)?
A: By finding a text file with passwords in Christian Pozzi's Truecrypt volume, which gave access to a Nagios server bridging the networks.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: What advice does the author give regarding attribution/OPSEC?
A: Use new servers/domains, paid for with new bitcoin addresses, and avoid reusing tools or techniques linked to previous identities.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: What vulnerability opened the door to the Exchange server?
A: Insecure backups found on iSCSI devices that were supposed to be on a separate network but were accessible from the main network.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: What is the purpose of the 'backdoored firmware' mentioned?
A: To maintain persistent access to the embedded device after using the initial exploit, protecting the exploit from discovery.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: Why did the author use a virtual machine routed through Tor?
A: To anonymize traffic and keep personal life separate from hacking activities.
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: What does the author say about 'NoSQL' databases?
A: They often lack authentication by default, making them easy targets ('NoAuthentication').
Montance Resource Google Drive
Phinphisher Hackback A DIY Guide
Q: How did the attacker download the email data?
A: Using PowerShell's 'New-MailboxExportRequest' cmdlets after gaining Domain Admin access.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What is the top challenge in implementing DevSecOps?
A: Insufficient budget/funding (44.4%).
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What percentage of organizations use cloud-hosted virtual machines?
A: Nearly 36% for production workloads.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What is the 'Paved Road' concept?
A: Providing developers with secure-by-default templates, tools, and services to make the secure path the easiest path.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What are the top three riskiest programming languages identified?
A: JavaScript (58.5%), Java (50.7%), and .NET (33.8%).
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What percentage of organizations perform security testing during the 'Requirements/Use Case' phase?
A: 39.5%.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What is 'Configuration Security Monitoring' (CSM)?
A: Tools that automatically verify configuration settings and enforce hardening policies to prevent drift.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What percentage of organizations repair critical vulnerabilities in less than 24 hours?
A: Only 8.2%.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What is the most common Continuous Integration (CI) tool?
A: On-premises open source tools like Jenkins (56.3%).
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What percentage of organizations have fully automated security metrics?
A: Only 5%.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What is 'Shift Left'?
A: Moving security testing and reviews earlier in the development lifecycle (e.g., during design/coding).
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What is 'Shift Right'?
A: Focusing on operational security, monitoring, and incident response in the production environment.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What percentage of respondents use AWS?
A: 85%.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What percentage of respondents use Microsoft Azure?
A: 84%.
Montance Resource Google Drive
Extending DevSecOps Security Controls Cloud Survey 39910
Q: What is the 'Escape Rate'?
A: The number of security issues discovered after deployment to production.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What are the three pillars of a Least Privilege Strategy in AWS?
A: 1. Identity and Access Management (IAM), 2. Network Access and Segmentation Design, 3. Cloud Security Posture Management (CSPM).
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is 'Compliance-forward cloud planning'?
A: The concept of making cloud infrastructure planning decisions based on adhering to compliance of data first, not as an afterthought.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is the shared responsibility model for AWS?
A: AWS is responsible for security *of* the cloud (infrastructure), while the customer is responsible for security *in* the cloud (data, applications, identity).
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is Amazon Macie used for?
A: A security service that uses machine learning to automatically discover, classify, and protect sensitive data (like PII) in AWS.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What are the two major types of visibility needed in the cloud?
A: 1. Event-driven visibility (logs, alerts from API calls), 2. Behavior-driven visibility (patterns over time like traffic flows).
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is the 'Pets vs. Cattle' concept in cloud security?
A: Pets are unique systems that require care (patching/fixing); Cattle are disposable systems that are replaced rather than fixed.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is Cloud Security Posture Management (CSPM)?
A: Tools that continuously monitor cloud environments to manage risk, maintain visibility, and understand operations across AWS accounts.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What service records API calls made in AWS?
A: AWS CloudTrail records API calls, including identity, time, source IP, and request parameters.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is 'S3 Block Public Access'?
A: A security feature that prevents S3 buckets from being publicly accessible via the internet.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is 'VPC Traffic Mirroring'?
A: A feature that copies network traffic from an elastic network interface to a target for deep packet inspection and monitoring.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is the 'Cyber Defense Matrix'?
A: A framework that maps the five NIST functions against five asset classes (Devices, Applications, Networks, Data, Users) to identify gaps.
Montance Resource Google Drive
Cloud Security Practical Guide To Security In The AWS Cloud
Q: What is 'Serverless' security?
A: Securing code and configuration without managing the underlying OS; focus on static code review, IAM privileges, and logging.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: What is the primary function of the Picus & Splunk integration?
A: To add threat-centric analytics to Security Operation Centers and validate detection capabilities.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: How does Picus interact with Splunk?
A: It constantly queries Splunk Enterprise Security with advanced algorithms and matches findings with threat emulation results.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: What is 'Picus Detection Analytics'?
A: An automated module that queries security events in SIEMs to analyze detection actions.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: What coverage does the Picus Threat Library offer?
A: More than 90% of the MITRE ATT&CK techniques.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: What is 'Continuous Security Validation'?
A: Regularly testing security defenses against evolving threats to ensure ongoing effectiveness.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: How does this solution help with 'Alert Fatigue'?
A: By identifying meaningful alerts and tuning out noise using validated correlation rules.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: What is 'Data Exfiltration' simulation?
A: Testing if data can be successfully stolen from the network without detection.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: What is 'Lateral Movement' simulation?
A: Testing if an attacker can move from a compromised host to other systems in the network.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: Does Picus provide Splunk-specific alert rules?
A: Yes, the integration provides Splunk-specific alert rules to address identified gaps.
Montance Resource Google Drive
Picus & Splunk Solution Brief
Q: What is the 'Picus Dictionary'?
A: A proprietary content of compromise indicators continually updated by Picus Labs.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: What is the main goal of the Picus & Carbon Black integration?
A: To help customers better utilize their EDR investments and validate endpoint detection capabilities.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: What is 'EDR'?
A: Endpoint Detection and Response.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: How does Picus help EDR admins?
A: By providing guidance on which existing rules/watchlists should be activated.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: What if a watchlist doesn't exist for a specific threat?
A: Picus Labs provides custom watchlists developed by their security experts.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: How are the watchlists delivered?
A: They are provided directly in the Picus UI.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: What is a 'Watchlist' in Carbon Black?
A: A saved search or rule used to detect specific events or behaviors.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: Does Picus test its watchlists?
A: Yes, Picus Labs applies rigorous testing to avoid false positives.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: What specific attack scenario is shown in the example?
A: Network Share Connection Removal Attack.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: What technique is used in the example attack?
A: JavaScript Execution via Rundll32.
Montance Resource Google Drive
Picus & VMware Carbon Black Sb (2020)
Q: What MITRE ATT&CK tactic is 'Rundll32' associated with?
A: Defense Evasion and Execution.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: What two products are integrated in this solution?
A: IBM QRadar SIEM and Picus Security Detection Analytics.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: What problem does this integration solve?
A: Inconsistent log delivery and lack of context over detection capabilities.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: What is the 'Picus Threat Library'?
A: A database containing thousands of real adversarial scenarios, malware, and exploits used for simulation.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: How does Picus minimize false positives in QRadar?
A: By running an internal validation process based on the Picus Dictionary of compromise indicators.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: What specific benefit does this offer Threat Hunters?
A: It allows them to build scenarios based on identified detection gaps.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: Does Picus provide QRadar rules?
A: Yes, it provides ready-to-apply, vendor-specific correlation rules.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: What framework is mapped to the detection analytics?
A: MITRE ATT&CK.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: What is the 'Picus Manager'?
A: The central component that stores emulation results and manages the validation process.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: How often does Picus Detection Analytics operate?
A: It has a 24x7 modus operandi.
Montance Resource Google Drive
Picus & IBM Solution Brief
Q: Can Picus identify log generation problems?
A: Yes, it helps identify log generation and collection problems.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What is the global IPv6 adoption rate mentioned?
A: 35%.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What country has 60% IPv6 adoption?
A: India.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What is 'SLAAC'?
A: Stateless Address Auto-Configuration, a mechanism for IPv6 hosts to configure themselves.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What new challenge does IPv6 bring for attackers?
A: The vastly larger address space makes traditional IP scanning/device discovery much harder.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What is 'Neighbor Discovery Protocol' (NDP)?
A: The IPv6 protocol that replaces ARP for discovering other nodes on the link.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What malware is mentioned as leveraging IPv6?
A: IRCTelnet and New Aidra DDoS botnets.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What is 'Shadow IoT'?
A: Unmanaged IoT devices connected to the network without IT knowledge.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What is the funding organization for this research?
A: Avast Software.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What is the 'Stratosphere Research Laboratory'?
A: The organization at Czech Technical University in Prague that conducted the research.
Montance Resource Google Drive
White Paper Current State Of IPv6 Security In IoT
Q: What tools need to be adapted for IPv6?
A: Defensive tools, monitoring technology, and penetration testing tools.
Montance Resource Google Drive
Hackback A DIY Guide
Q: What tool was used for internal network reconnaissance?
A: Powerview.
Montance Resource Google Drive
Hackback A DIY Guide
Q: How did the attacker pivot through the network?
A: Using a SOCKS proxy server and proxychains.
Montance Resource Google Drive
Hackback A DIY Guide
Q: What vulnerability was exploited?
A: A 0day in a spam filtering appliance.
Montance Resource Google Drive
Hackback A DIY Guide
Q: What specific tools were used for post-exploitation?
A: Busybox, nmap, Responder.py, Python, tcpdump, dsniff, socat, screen, SOCKS proxy, tgcd.
Montance Resource Google Drive
Hackback A DIY Guide
Q: How did the attacker access the 'Rete Sviluppo'?
A: By finding passwords in a Truecrypt volume that allowed access to a Nagios server bridging the networks.
Montance Resource Google Drive
Hackback A DIY Guide
Q: What is 'LLMNR/NBT-NS poisoning'?
A: A technique used by Responder.py to capture credentials from Windows machines on the local network.
Montance Resource Google Drive
Hackback A DIY Guide
Q: What is the 'NoAuthentication' vulnerability?
A: Refers to NoSQL databases (like MongoDB) often being deployed without authentication by default.
Montance Resource Google Drive
Hackback A DIY Guide
Q: What is 'Golden Ticket' persistence?
A: Forging a Kerberos Ticket Granting Ticket (TGT) to maintain unlimited access to a domain.
Montance Resource Google Drive
Hackback A DIY Guide
Q: Why avoid direct Tor connections?
A: To prevent correlation attacks; the author suggests using public Wi-Fi or bridge nodes.
Montance Resource Google Drive
Hackback A DIY Guide
Q: What is 'dsniff' used for?
A: Sniffing plaintext passwords and performing ARP spoofing.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What category does 'Threat Analysis' fall under?
A: Analyze.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What OPM code corresponds to 'Cyber Defense Forensics Analyst'?
A: 212.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What work role ID is associated with 'Cyber Crime Investigator'?
A: IN-INV-001.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What is the definition of 'Digital Forensics'?
A: Collects, processes, preserves, analyzes, and presents computer-related evidence in support of network vulnerability mitigation and/or criminal, fraud, counterintelligence, or law enforcement investigations.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What OPM code is used for 'Risk Management'?
A: 611 (Authorizing Official) and 612 (Security Control Assessor).
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What is the Work Role ID for 'Software Developer'?
A: SP-DEV-001.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: Which category includes 'Systems Administration'?
A: Operate and Maintain.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What is the definition of 'Protect and Defend'?
A: Identifies, analyzes, and mitigates threats to internal information technology (IT) systems or networks.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What Work Role ID is 'OM-NET-001'?
A: Network Operations Specialist.
Montance Resource Google Drive
Illustrative Mapping Of Certifications To NICE Framework Version 1.0
Q: What is the OPM code for 'Executive Cyber Leadership'?
A: 901.
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: What is the OPM Code for 'Program Manager'?
A: 801.
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: What is Task T0001?
A: Acquire and manage the necessary resources to support IT security goals.
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: What is KSA K0001?
A: Knowledge of computer networking concepts and protocols, and network security methodologies.
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: Which Work Role performs 'Network Operations'?
A: Network Operations Specialist (OM-NET-001).
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: What is Task T0161?
A: Perform analysis of log files from a variety of sources to identify possible threats.
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: What is KSA K0004?
A: Knowledge of cybersecurity and privacy principles.
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: Which role is responsible for 'Test and Evaluation' (TST)?
A: System Test & Evaluation Specialist (SP-TST-001).
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: What is the definition of the 'Analyze' category?
A: Specialty areas responsible for highly specialized review and evaluation of incoming cybersecurity information.
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: What is the OPM Code for 'Software Development'?
A: 621.
Montance Resource Google Drive
Supplement NICE Specialty Areas And Work Role KSAs And Tasks
Q: What is KSA S0027?
A: Skill in determining how a security system should work and how changes affect outcomes.
Montance Resource Google Drive
Technology Selection List
Q: What is the estimated purchase price for 'CyberCPR'?
A: $35,000.
Montance Resource Google Drive
Technology Selection List
Q: What tool is used for 'Availability Monitoring'?
A: What's Up.
Montance Resource Google Drive
Technology Selection List
Q: What is the estimated annual support percentage for 'CyberCPR'?
A: 35% of the purchase price.
Montance Resource Google Drive
Technology Selection List
Q: What tool is listed for 'Encryption for Communication'?
A: S/MIME certs using an external CA.
Montance Resource Google Drive
Technology Selection List
Q: Which function owns the 'Telephone System'?
A: Command Center.
Montance Resource Google Drive
Technology Selection List
Q: What is the 'Estimated Purchase Price' for 'Vulnerability Scanners' (Nessus/Burp)?
A: $3,000.
Montance Resource Google Drive
Technology Selection List
Q: What is the projected Year 3 Annual Maintenance Cost for 'Ticket Tracking System'?
A: Approximately $15,750.
Montance Resource Google Drive
Technology Selection List
Q: Does the 'SIEM' listed have an estimated purchase price?
A: No, it is listed as 0 (possibly implying existing sunk cost or open source).
Montance Resource Google Drive
Technology Selection List
Q: What hardware is reused for 'Assessment Development Environment'?
A: Repurposed hardware.
Montance Resource Google Drive
Technology Selection List
Q: What tool is used for 'Communication and Coordination Capabilities'?
A: Internal email.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: What is the specificity level for 'Tool update process'?
A: Exact Steps to Follow.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: What is the automation priority for 'Impact Assessment'?
A: Highest.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: What is the planned creation date for 'Review Policy'?
A: 2020-08-31.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: Does 'Shift Turn Over' have an existing SOP?
A: No.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: Which SOP is a candidate for 'Moderate' automation?
A: Receive Request.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: What is the automation priority for 'Deconfliction'?
A: Lowest.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: What group handles 'Notify Constituents'?
A: Command Center.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: What is the specificity level for 'SIEM hygiene & tune-up'?
A: Steps Plus Details.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: What is the planned creation date for 'New Log Source'?
A: 2020-05-01.
Montance Resource Google Drive
2020 05 SOAR SOC Process List
Q: What is the automation candidate status for 'Review Policy'?
A: None.
Montance Resource Google Drive
IR Scenarios General
Q: What is the first scenario described?
A: Third party breach involving AWS and Hotel Chains.
Montance Resource Google Drive
IR Scenarios General
Q: What is the second scenario described?
A: Intellectual Property Breach involving AWS.
Montance Resource Google Drive
IR Scenarios General
Q: What is the third scenario described?
A: Client Web Portal Compromise via SQL Injection.
Montance Resource Google Drive
IR Scenarios General
Q: What specific alert triggered the AWS scenario?
A: A news report from Krebs on Security about an AWS breach.
Montance Resource Google Drive
IR Scenarios General
Q: How long did the intruder operate in the AWS scenario?
A: Over the course of 14 months.
Montance Resource Google Drive
IR Scenarios General
Q: What data was affected in the Web Portal compromise?
A: Customer address, email, and purchase history.
Montance Resource Google Drive
IR Scenarios General
Q: What was the root cause of the Web Portal breach?
A: SQL injection against a connection between the web application and another internal application.
Montance Resource Google Drive
IR Scenarios General
Q: What containment step was suggested for the Web Portal?
A: Contacting the user by telephone, revoking access, or resetting passwords.
Montance Resource Google Drive
IR Scenarios General
Q: What did the malware analysis indicate in the AWS scenario?
A: Attackers zipped and encrypted data prior to exfiltration, but it is unknown if all data was collected.
Montance Resource Google Drive
IR Scenarios General
Q: What was the 'Wildcard' mentioned in preliminary considerations?
A: Identification of 3rd Party breaches, as it depends on notification from them.
Montance Resource Google Drive
2018 10 Links
Q: What is the URL for the threat tracking resource?
A: http://apt.threattracking.com
Montance Resource Google Drive
2018 10 Links
Q: What is the URL for the MGT517 Singapore link?
A: https://mgt517.com/2018-10-sing
Montance Resource Google Drive
2018 10 Links
Q: What is the purpose of the 'threattracking.com' link?
A: It likely provides intelligence on Advanced Persistent Threats (APTs).
Montance Resource Google Drive
2018 10 Links
Q: Is the MGT517 link an HTTP or HTTPS link?
A: HTTPS.
Montance Resource Google Drive
2018 10 Links
Q: What year is referenced in the text file name?
A: 2018.
Montance Resource Google Drive
2018 10 Links
Q: What month is referenced in the text file name?
A: October (10).
Montance Resource Google Drive
2018 10 Links
Q: Are there any other links in this file?
A: No, it appears to contain only two links.
Montance Resource Google Drive
2018 10 Links
Q: What class is MGT517 associated with?
A: SANS Managing Security Operations.
Montance Resource Google Drive
2018 10 Links
Q: Is the threat tracking link HTTP or HTTPS?
A: HTTP.
Montance Resource Google Drive
2018 10 Links
Q: What country is likely associated with 'sing' in the URL?
A: Singapore.
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 1?
A: Consolidate CND functions under one organization (the CSOC).
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 2?
A: Achieve balance between size and agility.
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 3?
A: Give the SOC the authority to do its job (organizational placement/policy).
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 4?
A: Do a few things well (avoid scope creep).
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 5?
A: Favor staff quality over quantity.
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 6?
A: Maximize the value of technology purchases.
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 7?
A: Exercise discrimination in the data you gather (signal vs. noise).
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 8?
A: Protect the SOC mission (secure the SOC infrastructure).
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 9?
A: Be a sophisticated consumer and producer of cyber threat intelligence.
Montance Resource Google Drive
Zimmerman Mitre 10 Strategies Cyber Ops Center
Q: What is Strategy 10?
A: Stop. Think. Respond... Calmly.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What is a 'Tier V-VI' attacker?
A: A state actor able to invest billions of dollars and years of time to create vulnerabilities in systems.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What is the 'Red Queen' hypothesis?
A: The concept that the defender must expend all effort just to stay in the same relative place against an evolving adversary.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What is an 'Existential Cyber Attack'?
A: An attack capable of causing sufficient wide-scale damage for the government to potentially lose control of the country.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What is 'Resilience' defined as in this report?
A: The ability to provide acceptable operations despite disruption: natural or man-made, inadvertent or deliberate.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What is the 'Gold Standard' for restoration?
A: Restoring a system to a known, trusted state.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: Why is 'Defense-only' considered a failed strategy?
A: Because it is impossible to fully defend against Tier V-VI threats; deterrence and resilience are also required.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What is the 'Cyber Threat Taxonomy'?
A: A hierarchy dividing threats into Tiers I-VI based on skill level and resources.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What is 'Cyber Critical Survivable Mission'?
A: A specific force or capability segmented and hardened to ensure mission execution in a cyber-stressed environment.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What is the recommendation regarding Nuclear Strike?
A: Protect the nuclear strike capability to ensure it remains a credible deterrent against existential cyber attacks.
Montance Resource Google Drive
Resilient Military Systems Cyber Threat
Q: What are the three parameters of Cyber Risk defined in the report?
A: Threat (Intent/Capability), Vulnerabilities (Inherent/Introduced), and Consequences (Fixable/Fatal).
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: How does the 'Follow the Sun' model depicted impact SOC staffing?
A: It allows for 24/7 coverage without requiring night shifts in every region, improving analyst quality of life and retention.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: What is the operational challenge of the 'Data Sovereignty' implied by the EU swimlane?
A: The SOC must ensure that log data from EU citizens stays within the EU (or compliant systems) while still maintaining global visibility.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: How does the diagram suggest 'Handoffs' occur?
A: It likely shows overlap periods where regions synchronize context before transferring control, critical for continuity.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: What is the role of the 'Tier 3' function in a distributed model?
A: It often serves as a global center of excellence, handling the most complex cases regardless of where they originated.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: How does 'Regional' vs. 'Global' policy application differ?
A: Regional SOCs apply local context and compliance rules, while Global applies broad threat intelligence and corporate policy.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: What is the 'Resilience' advantage of this multi-SOC architecture?
A: If one SOC goes offline (e.g., weather, connectivity), operations can be shifted to another region.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: How does the diagram address 'Latency' in decision making?
A: By empowering regional SOCs to make Triage/Containment decisions locally, reducing the delay of consulting a central HQ.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: What implies the need for a 'Unified Platform'?
A: For this model to work, all regions must access the same ticketing and SIEM data (logically, if not physically) to collaborate.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: What is the 'Cultural' consideration in this model?
A: Different regions may have different risk tolerances and communication styles, requiring standardized operating procedures.
Montance Resource Google Drive
Swimlane Multisoc Generic US EU AUS
Q: How does this model support 'Insider Threat' detection?
A: Regional analysts are better positioned to understand local context and behavioral anomalies that a remote global analyst might miss.
Montance Resource Google Drive
Look At Closer
Q: What is the source of the patterns listed in this document?
A: Private email from James Butterworth (Sands Corp).
Montance Resource Google Drive
Look At Closer
Q: What file property pattern is listed as suspicious?
A: PE Checksum = "0".
Montance Resource Google Drive
Look At Closer
Q: What specific URL strings should be watched?
A: Any URL that contains "HXXP" or "H00P".
Montance Resource Google Drive
Look At Closer
Q: What registry key is mentioned for autostart?
A: HKLM.../Current Version/Run.
Montance Resource Google Drive
Look At Closer
Q: What is a suspicious indicator regarding file archives?
A: Any file archive larger than 2Gb (Zip/Rar/Etc).
Montance Resource Google Drive
Look At Closer
Q: What user behavior is flagged regarding RDP?
A: User logging into another machine via RDP (excluding Admin Accounts).
Montance Resource Google Drive
Look At Closer
Q: What service query is listed as suspicious?
A: Service queries "http://ipinfo.io/".
Montance Resource Google Drive
Look At Closer
Q: What indicator relates to IRC?
A: Open IRC Connections (Sessions) - Not using common IRC Ports.
Montance Resource Google Drive
Look At Closer
Q: What pattern indicates a 'Hidden' service?
A: Service Flagged as "Hidden".
Montance Resource Google Drive
Look At Closer
Q: What file extensions are mentioned in the context of stolen signing certificates?
A: ".CN" or ".KR".
Montance Resource Google Drive
Security Certifications
Q: What does GCIH stand for?
A: GIAC Certified Incident Handler.
Montance Resource Google Drive
Security Certifications
Q: What does CISSP stand for?
A: Certified Information Systems Security Professional.
Montance Resource Google Drive
Security Certifications
Q: What is the 'Offensive Security' certification listed?
A: OSCP (Offensive Security Certified Professional).
Montance Resource Google Drive
Security Certifications
Q: What does CCIE Security stand for?
A: Cisco Certified Internetwork Expert Security.
Montance Resource Google Drive
Security Certifications
Q: Which certification is related to Industrial Control Systems?
A: GICSP (Global Industrial Cyber Security Professional).
Montance Resource Google Drive
Security Certifications
Q: What does GREM stand for?
A: GIAC Reverse Engineering Malware.
Montance Resource Google Drive
Security Certifications
Q: What does CEH stand for?
A: Certified Ethical Hacker.
Montance Resource Google Drive
Security Certifications
Q: What color represents 'Defensive' certifications in the key?
A: Green (implied/labeled).
Montance Resource Google Drive
Security Certifications
Q: What color represents 'Offensive' certifications in the key?
A: Red (implied/labeled).
Montance Resource Google Drive
Security Certifications
Q: What is the certification 'CISA'?
A: Certified Information Systems Auditor.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What is the estimated financial loss from 700 million compromised records?
A: $400 Million.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What percentage of recipients opened phishing messages?
A: 23%.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What percentage of recipients clicked on attachments in phishing messages?
A: 11%.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What are the three top industries affected?
A: Public, Information, and Financial Services.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What is the primary motive for most attacks?
A: Financial gain.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What percentage of attacks involved a secondary victim?
A: Nearly 70%.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What is 'RAM Scraping'?
A: Malware that extracts data from volatile memory, often used in POS intrusions.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What proportion of exploits used vulnerabilities patched more than a year ago?
A: 99.9%.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: What is the 'Detection Deficit'?
A: The gap between time to compromise and time to discovery.
Montance Resource Google Drive
Rp Data Breach Investigation Report 2015 En Xg
Q: How many organizations contributed to the 2015 DBIR?
A: 70 organizations.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: What is the 'black box' cloud model?
A: A model where customers implicitly give up the right to direct how and when most tasks are performed.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: What is the remedy for the stress of the 'black box' model?
A: Robust service-level agreements (SLAs) tailored to the as-a-service paradigm.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: What should be included alongside an SLA?
A: A service specifications document spelling out respective responsibilities.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: What should you avoid in SLA remedies?
A: Limitations on further remedies, such as consequential damages or the option to terminate without liability.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: Why should you avoid 'Performance credits are the sole remedy' clauses?
A: Because they limit your right to pursue additional damages in cases of gross negligence.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: What is the recommended credit percentage for missed SLAs?
A: 15% credit payment is a typical calibration for a total of 100 points.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: What should be defined regarding data removal?
A: The customer's ability to remove data from the cloud and the mechanisms for doing so.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: What is a 'Service Level Objective' vs. SLA?
A: An objective is a target; an SLA is a contract with penalties.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: Who is the author of this article?
A: Jonathan Shaw, a principal at Pace Harmon.
Montance Resource Google Drive
Informationweek Don't Get Burned 4 Steps To A Cloud SLA
Q: What date was this article published?
A: 9/28/2011.
Montance Resource Google Drive
Free SCADA Training
Q: What organization offers the training listed?
A: ICS-CERT (Industrial Control Systems Cyber Emergency Response Team).
Montance Resource Google Drive
Free SCADA Training
Q: What is the URL for training availability?
A: https://ics-cert.us-cert.gov/Training-Available-Through-ICS-CERT
Montance Resource Google Drive
Free SCADA Training
Q: What is the URL for the training calendar?
A: https://ics-cert.us-cert.gov/Calendar
Montance Resource Google Drive
Free SCADA Training
Q: What is SCADA?
A: Supervisory Control and Data Acquisition.
Montance Resource Google Drive
Free SCADA Training
Q: Is the training free?
A: Yes, the filename implies it is 'FREE SCADA TRAINING'.
Montance Resource Google Drive
Free SCADA Training
Q: Who is the target audience?
A: Professionals working with Industrial Control Systems.
Montance Resource Google Drive
Free SCADA Training
Q: Is this a US government resource?
A: Yes, the URL ends in .gov.
Montance Resource Google Drive
Free SCADA Training
Q: What is the primary focus of the training?
A: ICS Security.
Montance Resource Google Drive
Free SCADA Training
Q: Does the file contain any other text?
A: No, just the two URLs.
Montance Resource Google Drive
Free SCADA Training
Q: What protocol is implied by the secure links?
A: HTTPS.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: What percentage of incidents in the 2014 dataset were described by nine basic patterns?
A: 92%.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: How many incidents were analyzed in the 2014 report?
A: Over 100,000 incidents from the last 10 years.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: List three of the nine basic patterns identified.
A: Point-of-Sale Intrusions, Web App Attacks, Insider Misuse.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: What was the most common pattern for 'Espionage'?
A: Cyber-Espionage.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: Who were some of the contributors to the 2014 DBIR?
A: CERT, McAfee, Deloitte, US Secret Service, Splunk.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: What is the 'Detection Deficit'?
A: The time gap between compromise and discovery.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: What percentage of breaches were financially motivated?
A: This is typically the vast majority, though the exact 2014 figure is in the detailed text.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: What pattern is associated with 'skimmers'?
A: Payment Card Skimmers.
Montance Resource Google Drive
Rp Verizon DBIR 2014 En Xg
Q: What pattern involves 'Physical Theft and Loss'?
A: Physical Theft and Loss.
Montance Resource Google Drive
Tabletop Interview
Q: What is the first question asked in the pre-tabletop interview?
A: Who will be participating in the TableTop exercise? Legal? HR? Data Owners?
Montance Resource Google Drive
Tabletop Interview
Q: What staffing question is asked?
A: Current Size of your IR Team? Dedicated or Surge?
Montance Resource Google Drive
Tabletop Interview
Q: What policy question is asked regarding authorization?
A: Does your policy provide authorization to pull systems offline?
Montance Resource Google Drive
Tabletop Interview
Q: What technical capabilities are queried?
A: Centralized logging/SIEM, Network IDS, Packet Capture, Host IDS.
Montance Resource Google Drive
Tabletop Interview
Q: What endpoint question is asked?
A: Any endpoint forensic agent in place? what tools are currently being used?
Montance Resource Google Drive
Tabletop Interview
Q: What external factors are considered?
A: Externally facing web servers? Third party service providers? Cloud service providers?
Montance Resource Google Drive
Tabletop Interview
Q: What user access questions are asked?
A: Do users VPN? Prevalence and Policy concerning Mobile Devices, BYOD? Dual Factor Authentication?
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: How does the 'OODA Loop' concept apply to automating incident response?
A: It emphasizes that automation should speed up the 'Observe' and 'Act' phases to disrupt the adversary's cycle faster than they can adapt.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: What specific criteria should be used to select processes for automation?
A: Processes that are high-volume, repetitive, well-documented, and have a low risk of negative impact if an automated action fails.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: Why is 'Context' critical when automating the containment phase?
A: Blind automation (e.g., blocking an IP) without context can disrupt critical business functions; context ensures the asset's role is understood before action.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: What is the 'Human-in-the-loop' requirement for critical decisions?
A: While data collection can be fully automated, high-impact decisions like taking a core server offline should require human validation.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: How does the document suggest measuring the ROI of automation?
A: By calculating the reduction in 'Mean Time to Respond' (MTTR) and the equivalent analyst hours saved per incident.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: What is the risk of automating bad processes?
A: Automation magnifies inefficiencies; a flawed manual process becomes a faster, high-volume flaw when automated.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: How should 'Playbooks' evolve with automation?
A: They must transition from static documents to dynamic, machine-readable workflows that can be executed by SOAR platforms.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: What role does 'Threat Intelligence' play in automated detection?
A: It provides the indicators (IOCs) that automated systems use to filter noise and trigger high-fidelity alerts.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: What is the recommended approach to handling 'False Positives' in an automated system?
A: Implement a feedback loop where analyst dispositions ('False Positive') automatically tune the detection logic to prevent recurrence.
Montance Resource Google Drive
Automation Incident Response Process Creating Effective Long Term Plan
Q: How does automation support 'Scalability' in incident response?
A: It decouples the volume of alerts from the number of analysts, allowing the SOC to handle spikes in activity without linear staffing increases.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: What distinguishes the 'CyberRX' exercise methodology from a standard tabletop?
A: It focuses specifically on the healthcare sector's unique constraints, such as patient safety and medical device availability, rather than just IT systems.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: In the Level 1 scenario, how does the 'Medical Device' compromise impact clinical operations?
A: It forces a fallback to manual procedures, potentially delaying patient care and increasing the risk of medical errors.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: What is the strategic value of including 'Executive Leadership' in this specific exercise?
A: To validate decision-making authorities regarding system shutdowns that could impact patient health versus data security.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: How does the playbook suggest handling 'Public Relations' during a ransomware event?
A: By having pre-approved templates for communication that address patient safety concerns first, before technical details.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: What specific 'Inject' is used to escalate the scenario intensity?
A: Reports of patient data appearing on the dark web or direct threats to life-safety systems.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: What is the role of the 'Scribe' in the CyberRX methodology?
A: To capture not just the decisions made, but the *gaps* in information that hindered decision-making during the exercise.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: How does the exercise address 'Third-Party Risk'?
A: By introducing a scenario where the compromise originates from a vendor or connected partner, testing the organization's ability to coordinate response.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: What is the 'Hot Wash' objective immediately following the exercise?
A: To capture immediate impressions and emotional responses to the pressure before they fade, identifying cultural or communication breakdowns.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: How does the playbook recommend measuring 'Resilience'?
A: By the ability of clinical operations to continue functioning effectively while IT systems are unavailable.
Montance Resource Google Drive
Cyberrx2playbook Lvli
Q: What specific regulatory concern is highlighted in the healthcare scenario?
A: The tension between HIPAA privacy requirements (not disclosing patient data) and the need to share threat indicators with law enforcement.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: What specific decision point distinguishes the 'Containment' phase in a data loss scenario?
A: The decision to disconnect affected systems from the internet to stop exfiltration versus keeping them online to monitor the attacker's activity.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: How does the template suggest assessing 'Legal' involvement?
A: By determining at what specific threshold (e.g., number of records, type of data) legal counsel must be engaged to direct the investigation.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: What is the critical 'Evidence Preservation' step mentioned?
A: Ensuring that volatile data (RAM) is captured before systems are powered down, which is often missed in panic responses.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: How does the scenario address 'Internal Communication'?
A: It tests whether there is a secure, out-of-band communication channel (e.g., Signal, non-corporate email) if the primary email system is compromised.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: What is the 'HR' role in a data loss incident involving an insider?
A: Managing the suspect employee (suspension, interview) without alerting them to the investigation prematurely.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: How does the template measure 'Readiness'?
A: By evaluating if the team had access to the necessary tools (forensic software, log aggregators) and permissions during the exercise.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: What is the strategic implication of 'Public Disclosure' in this scenario?
A: Balancing the need for transparency with the risk of tipping off the attacker or causing undue panic among customers.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: What specific 'Gap Analysis' outcome is expected?
A: Identifying specific logs or data sources that were needed for investigation but were unavailable or insufficient.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: How does the template suggest handling 'Remote Employees'?
A: Testing the capability to isolate or wipe devices that are not physically on the corporate network.
Montance Resource Google Drive
Data Loss Tabletop Template
Q: What is the 'Recovery' objective in a data loss scenario?
A: Not just restoring systems, but validating that the exfiltrated data has been identified and the vulnerability closed.
Montance Resource Google Drive
Lkr2015222
Q: What operational shift does Crowley recommend for Japanese companies compared to US companies?
A: Moving away from a pure prevention/compliance mindset to one that embraces active detection and response capabilities.
Montance Resource Google Drive
Lkr2015222
Q: How does the 'Detection Deficit' impact SOC strategy?
A: It necessitates a shift in investment towards 'Threat Hunting' to find adversaries who have already bypassed preventive controls.
Montance Resource Google Drive
Lkr2015222
Q: What is the specific value of 'Threat Intelligence' described in the interview?
A: It allows the SOC to move from reacting to generic alerts to anticipating specific adversary tactics (TTPs) relevant to their industry.
Montance Resource Google Drive
Lkr2015222
Q: What is the 'Cultural Barrier' to effective incident response mentioned?
A: The hesitation to report bad news or admit failure, which delays the activation of the incident response plan.
Montance Resource Google Drive
Lkr2015222
Q: How does Crowley define the 'Active Defense' concept?
A: Proactively engaging with the adversary's presence (e.g., through deception or disruption) rather than just blocking IPs.
Montance Resource Google Drive
Lkr2015222
Q: What is the recommended approach to 'metrics' for a maturing SOC?
A: Focusing on 'Time to Detect' and 'Time to Contain' rather than the volume of alerts or blocks.
Montance Resource Google Drive
Lkr2015222
Q: How should organizations address the 'Skills Gap' according to this document?
A: By investing in internal training and creating a culture of continuous learning, rather than relying solely on hiring external experts.
Montance Resource Google Drive
Lkr2015222
Q: What is the role of 'Automation' in the context of the interview?
A: To handle low-level, repetitive triage tasks so that human analysts can focus on complex investigations.
Montance Resource Google Drive
Lkr2015222
Q: What is the 'Assume Breach' mentality?
A: Operating under the assumption that the network is already compromised, which drives proactive hunting and monitoring.
Montance Resource Google Drive
Lkr2015222
Q: How does the document characterize the evolution of 'Malware'?
A: As becoming increasingly targeted and evasive, requiring behavioral analysis rather than just signature-based detection.
Montance Resource Google Drive
Magma UCF Tool
Q: How does the 'Magma' framework facilitate 'Use Case' management?
A: By mapping high-level business drivers (e.g., protect IP) to specific threat scenarios and the technical rules required to detect them.
Montance Resource Google Drive
Magma UCF Tool
Q: What is the operational value of the 'Detection Gap' metric?
A: It quantifies the difference between the threats the organization *wants* to detect and what it *can* currently detect, guiding budget and engineering priorities.
Montance Resource Google Drive
Magma UCF Tool
Q: How does the tool categorize 'L1 Use Cases'?
A: They represent broad threat categories (e.g., Malware, Intrusion) that align with business risks.
Montance Resource Google Drive
Magma UCF Tool
Q: What is the relationship between 'L2' and 'L3' use cases?
A: L2 describes the specific threat activity (e.g., Phishing), while L3 describes the technical implementation (e.g., Outlook rule for suspicious subjects).
Montance Resource Google Drive
Magma UCF Tool
Q: How does mapping use cases to 'MITRE ATT&CK' enhance SOC maturity?
A: It allows the SOC to visualize coverage against known adversary tactics and techniques, identifying blind spots.
Montance Resource Google Drive
Magma UCF Tool
Q: What is the purpose of the 'Business Drivers' tab?
A: To force the SOC to justify every detection rule based on a specific business risk or compliance requirement, preventing 'alert bloat'.
Montance Resource Google Drive
Magma UCF Tool
Q: How can the tool be used for 'Log Source' prioritization?
A: By identifying which log sources are required for the highest-value use cases, optimizing data ingestion costs.
Montance Resource Google Drive
Magma UCF Tool
Q: What is the 'Effectiveness' metric in the tool?
A: A qualitative measure of how well a specific rule detects the intended threat without excessive false positives.
Montance Resource Google Drive
Magma UCF Tool
Q: How does the 'Implementation' status track SOC progress?
A: It provides a clear view of the engineering backlog, showing which use cases are defined, in testing, or fully operational.
Montance Resource Google Drive
Magma UCF Tool
Q: What is the strategic benefit of the 'Visualizations' provided by the tool?
A: They allow SOC managers to communicate coverage and gaps to non-technical stakeholders using business-aligned categories.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: What distinguishes the 'Analytical Time Frame' from the 'Operational Time Frame' in a SOC?
A: Operational focuses on real-time triage (minutes/hours), while Analytical focuses on long-term trend analysis, hunting, and root cause (days/weeks).
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: How does the 'Golden Triangle' concept influence SOC architecture?
A: It mandates that Technology must support defined Processes, which are executed by skilled People; buying tools without people/process fails.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: What is the 'Hybrid SOC' model's primary advantage?
A: It allows an organization to maintain 24/7 monitoring via an MSSP while keeping deep institutional knowledge and IR capability in-house.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: What specific role does 'Situational Awareness' play in SOC management?
A: It enables the SOC to understand the business impact of an incident immediately, prioritizing response based on asset criticality.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: How should 'Shift Turnover' be operationalized to prevent knowledge loss?
A: Through structured, mandatory briefings where active incidents and context are verbally and electronically transferred to the incoming team.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: What is the strategic value of 'Cost Avoidance' metrics?
A: Demonstrating SOC value by calculating the potential financial impact of incidents that were prevented or contained early.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: How does the roadmap suggest handling 'Tier 1' analyst burnout?
A: By implementing automation for repetitive triage tasks and providing clear career progression paths to Tier 2/3.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: What is the 'Feedback Loop' essential for SOC maturity?
A: The process of using data from investigations to tune detection rules and update prevention controls, closing the security cycle.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: How does the document define the 'Mission' of a SOC?
A: To provide continuous monitoring and detection capabilities that align with and support the organization's specific risk tolerance.
Montance Resource Google Drive
RSA Advanced SOC Solution Sans SOC Roadmap Whitepaper
Q: What is the role of 'Threat Intelligence' in the described SOC roadmap?
A: It moves the SOC from reactive to proactive by enabling the search for indicators of specific adversaries targeting the sector.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: How does 'Serverless' architecture change the incident response paradigm?
A: It eliminates the ability to perform traditional disk forensics (no persistent OS), forcing reliance on logs and API activity data.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: What specific AWS service is identified as critical for 'Post-Mortem' analysis?
A: CloudTrail, as it provides the immutable record of all API calls made within the environment.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: What is the operational benefit of 'Automated Forensics' in the cloud?
A: The ability to automatically snapshot, isolate, and analyze a compromised instance immediately upon detection, preserving volatile evidence.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: How does 'MFA Delete' contribute to data resilience?
A: It prevents an attacker (even with compromised credentials) from permanently deleting S3 backups without a second factor.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: What is the 'Shared Responsibility' implication for logging?
A: AWS ensures the availability of the logging service (CloudTrail), but the customer is responsible for configuring it, retaining the logs, and analyzing them.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: How can 'VPC Flow Logs' be utilized for threat hunting?
A: They provide visibility into network traffic patterns *within* the cloud environment, allowing detection of lateral movement between instances.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: What is the security value of 'IAM' roles over long-term access keys?
A: Roles use temporary credentials that rotate automatically, reducing the impact of credential theft compared to static keys.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: What is the 'Immutable Infrastructure' concept mentioned?
A: Replacing compromised instances with fresh ones rather than patching/fixing them, ensuring a clean state and destroying persistence.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: How does the 'ThreatResponse-Cloud' tool aid analysts?
A: It automates the collection of evidence and containment actions (e.g., security group isolation) via API, speeding up response.
Montance Resource Google Drive
US 16 Krug Hardening AWS Environments
Q: What is the specific challenge of 'Physical Access' in cloud IR?
A: You cannot physically disconnect a server or pull a hard drive; all containment and acquisition must be done logically via software/API.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What tool did internal security use in the PHI case?
A: Redline.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What did the external consultants recommend initially?
A: Deploying IR agents to all machines (a $300k cost).
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What was the result of Rendition's 'second opinion'?
A: They descoped two systems and validated the original indicators were false positives.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What is 'ACH'?
A: Analysis of Competing Hypotheses.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: How did Rendition decrypt the ransomware files?
A: They located the key for one machine in memory.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What is the risk of paying the ransom?
A: It identifies you as a target who pays and lacks backups.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What should be done after paying a ransom?
A: Perform threat hunting to ensure the attacker has no remaining access.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What administrative change was recommended post-ransomware?
A: Remove local admin rights from most users.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What technology was disabled by admins to save disk space?
A: Volume Shadow Copies.
Montance Resource Google Drive
Rendition Infosec Case Studies
Q: What was found during the post-ransomware threat hunt?
A: Two remote access trojans.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: What date was Mandiant contracted?
A: October 12, 2012.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: What triggered the investigation?
A: Law enforcement contacted the DoR on Oct 10, 2012, regarding stolen PII.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: What was the initial entry vector?
A: A phishing email sent on August 13, 2012.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: How many valid user accounts were compromised?
A: At least four.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: What encryption method was used for the data?
A: AES 256-bit encryption.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: Did the attacker get the keys?
A: The attacker stole the data key but not the Key Encrypting Key (KEK).
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: How much data was exfiltrated?
A: Approx 8.2 GB compressed, 74.7 GB uncompressed.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: What format was the data exfiltrated in?
A: Encrypted 7-zip archives.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: How did the attacker move laterally?
A: Using stolen credentials to log into the Citrix remote access portal.
Montance Resource Google Drive
Mandiant Report 0 South Carolina
Q: When was the containment plan executed?
A: October 19-20, 2012.
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What was the root cause of the majority of incidents in 2017?
A: Malware.
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What are the main shortages faced by IR teams?
A: Skilled staff, lack of ownership, and business silos.
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What year brought 'unprecedented events'?
A: 2016 (Election, shadow brokers, etc.).
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What is the name of this survey?
A: 'The Show Must Go On!'
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: Who sponsored the survey?
A: AlienVault, IBM Security, McAfee, etc.
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What is the focus of the survey?
A: Incident Response capabilities and challenges.
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What is a key recommendation for improvement?
A: Building IR teams that suit the specific environment.
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What is the 'Prevention' vs 'Response' balance?
A: A shift towards acknowledging prevention failure and needing robust response.
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What role does 'Threat Intelligence' play?
A: It is becoming integral to IR for context.
Montance Resource Google Drive
Show On 2017 Incident Response Survey 37815
Q: What is the 'dwell time' trend?
A: Ideally decreasing, but still a challenge.
Montance Resource Google Drive
Incident Cost
Q: What are the main cost categories?
A: SOC Staff, Non-SOC Staff, Outsource Staff, Expenses, Losses.
Montance Resource Google Drive
Incident Cost
Q: What functional areas are tracked for SOC Staff?
A: Command Center, NSM, IR, Forensics, Threat Intel, Self-Assessment.
Montance Resource Google Drive
Incident Cost
Q: What expenses are tracked?
A: Travel, Material, Hardware, Software.
Montance Resource Google Drive
Incident Cost
Q: What 'Losses' are calculated?
A: Lost customers, Lost sales, Stock Price Decrease.
Montance Resource Google Drive
Incident Cost
Q: What is included in 'Increased Cost of Operation'?
A: Additional borrowing costs and increased cyber insurance.
Montance Resource Google Drive
Incident Cost
Q: What is 'Credit Monitoring' cost based on?
A: Annual cost per person affected and years to monitor.
Montance Resource Google Drive
Incident Cost
Q: What is the 'Daily Operational Rate'?
A: A calculated rate for alternative cost estimation.
Montance Resource Google Drive
Incident Cost
Q: What non-SOC staff are tracked?
A: Legal, PR, HR, IT Operations.
Montance Resource Google Drive
Incident Cost
Q: Is the 'Estimated Total' automatically calculated?
A: Yes, based on the input fields.
Montance Resource Google Drive
Incident Cost
Q: What is the purpose of this spreadsheet?
A: To estimate the total financial impact of a security incident.
Montance Resource Google Drive
Charter With Webbug
Q: What is the Mission of the SOC?
A: To address cybersecurity threats of opportunistic, well-funded, and nation-state levels.
Montance Resource Google Drive
Charter With Webbug
Q: What is the Vision of the SOC?
A: To assure compliance and exist as a learning capability that keeps pace with threats.
Montance Resource Google Drive
Charter With Webbug
Q: What are the Operational Hours?
A: 24 hours per day, every day.
Montance Resource Google Drive
Charter With Webbug
Q: What is the Statement of Success?
A: When it intervenes in adversary efforts to impact availability, confidentiality, and integrity.
Montance Resource Google Drive
Charter With Webbug
Q: What is the strategy for staffing?
A: A combination of on-premises, on-call, and outsourced contracts.
Montance Resource Google Drive
Charter With Webbug
Q: What is the role of the Steering Committee?
A: To provide governance and direction.
Montance Resource Google Drive
Charter With Webbug
Q: What metrics are collected?
A: Performance metrics reported monthly to stakeholders.
Montance Resource Google Drive
Charter With Webbug
Q: What does 'MERGE_BUSINESSNAME' represent?
A: A placeholder for the organization's name.
Montance Resource Google Drive
Charter With Webbug
Q: What license is this charter shared under?
A: Creative Commons Share Alike 4.0.
Montance Resource Google Drive
Charter With Webbug
Q: What is the purpose of the 'Web Bug'?
A: To track redistribution of the document.
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What tool is listed for 'External Threat Feeds'?
A: ThreatConnect.
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What tool is used for 'Internal Portal for IOC Tracking'?
A: MISP.
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What is the 'Open Source Option' for Vulnerability Scanning?
A: OpenVAS.
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What tool is listed for 'Forensic Workstations'?
A: SIFT (SANS Investigative Forensic Toolkit).
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What tool is used for 'Code manipulation' (Android)?
A: JaD-X.
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What tool is listed as 'Enterprise Tier' for Threat Intel?
A: Recorded Future.
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What is 'CyberChef' used for?
A: Data manipulation and decoding (Forensics).
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What tool is used for 'Tracking and Remediation'?
A: JIRA (implied by 'Database/Spreadsheets' or similar context in other lists, but here 'Spreadsheets' is listed).
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What is 'GDB'?
A: A debugger (GNU Debugger).
Montance Resource Google Drive
2020 06 15 Updated Tool Inventory
Q: What is 'Fred'?
A: A forensic purpose-built workstation.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: How does the 'Catastrophic' financial threshold impact IR decision making?
A: It triggers immediate executive/board involvement and potentially activates cyber insurance policies.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: What is the strategic value of quantifying 'Brand/Image' impact?
A: It allows the SOC to prioritize incidents that may have low technical impact but high reputational damage (e.g., defacement, executive email leak).
Montance Resource Google Drive
Incident Impact Quantification Example
Q: How does the 'Legal Liability' category influence notification timelines?
A: High liability incidents (e.g., GDPR data breach) have strict statutory notification windows that dictate the pace of the response.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: What is the purpose of the 'Steering Committee' audience for this deck?
A: To obtain pre-authorization for response actions based on impact thresholds, avoiding decision paralysis during a crisis.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: How does this framework support 'Resource Allocation'?
A: It ensures that expensive response resources (forensics, outside counsel) are reserved for High/Catastrophic incidents.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: What implies the need for 'Cross-Functional' response?
A: Categories like Brand and Legal require PR and Legal teams, not just IT, to be part of the incident response plan.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: How does 'US-CERT' alignment help the organization?
A: It standardizes terminology, making it easier to share information with government bodies and industry peers.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: What is the operational risk of misclassifying an incident's impact?
A: Under-classifying leads to inadequate response and increased damage; over-classifying wastes resources and causes executive fatigue.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: How does 'Customer Loss' quantification drive security investment?
A: It directly links security failures to revenue loss, providing a compelling business case for security budget.
Montance Resource Google Drive
Incident Impact Quantification Example
Q: What is the role of the 'Scorecard' approach in incident review?
A: It provides an objective, post-incident way to evaluate if the response was appropriate for the actual impact.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: What operational trend is indicated by the shift from 'Threat Research' to 'Pen-testing' as a top outsourced function?
A: Organizations are prioritizing active validation of their defenses (red teaming) over passive intelligence gathering, likely due to the need to prove security posture.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: How does the increase in 'Purple-team' activities reflect SOC maturity?
A: It suggests a move towards collaborative testing where defenders learn directly from attackers, improving detection logic faster than traditional red teaming.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: What implies the 'Integration' challenge in the survey results?
A: The high number of respondents using multiple, disparate tools without a central orchestration layer, leading to inefficiency.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: What is the significance of the 'Digital Forensics' outsourcing percentage?
A: It indicates that while detection is often internal, the specialized, high-liability skill of deep forensics is still frequently handled by external experts.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: How does the data support the 'Skills Gap' narrative?
A: The continued reliance on outsourcing for specialized roles (Red Team, Forensics) underscores the difficulty in hiring and retaining these skills in-house.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: What trend is visible regarding 'Security Monitoring'?
A: A slight shift towards hybrid models, suggesting that while 24/7 eyes-on-glass is commoditized, organizations want to keep the analytical context internal.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: What does the rise in 'eDiscovery' outsourcing suggest about the SOC's role?
A: That SOCs are increasingly involved in legal and HR investigations, necessitating a formal interface with legal counsel.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: How does the survey reflect the adoption of 'Threat Hunting'?
A: It shows hunting moving from a niche activity to a core SOC function, though often constrained by resource availability.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: What is the operational impact of the 'Respondent Size' doubling?
A: It suggests a broader awareness and formalization of SOC structures across more organizations, not just large enterprises.
Montance Resource Google Drive
2017 2018 SOC Survey Comparisons
Q: What does the data say about 'Budget' allocation trends?
A: There is a shift towards spending on services (people/skills) rather than just hardware/software, reflecting the realization that tools alone don't stop breaches.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: What is the operational purpose of the 'Immediate/High/Moderate' classification?
A: To prioritize remediation efforts based on risk, ensuring that critical vulnerabilities are addressed before less severe ones.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: How does the 'Verification Method' field enhance accountability?
A: It requires a specific, testable criterion for closure, preventing teams from simply marking items as 'done' without proof.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: What is the strategic value of the 'Actions Suggested' section?
A: It allows the SOC to provide consulting value and best practices to business units without expending political capital on mandatory requirements.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: How does this report bridge the gap between 'Technical' and 'Managerial' views?
A: By translating technical findings (e.g., missing patch) into risk-based actions (e.g., High Action Required) that management can enforce.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: What is the role of the 'Responsible Party' field?
A: It assigns clear ownership, preventing remediation tasks from falling into the gaps between teams.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: How does the 'Due Date' field support compliance?
A: It creates a measurable SLA for remediation, which can be tracked and reported to executive leadership.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: What implies the 'Continuous Improvement' aspect of this report?
A: It is not just a one-time audit but a recurring mechanism to lift the organization's security baseline over time.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: How does the 'Mandatory Policy' reference strengthen the SOC's authority?
A: It ties technical requests to established organizational policy, making compliance non-negotiable.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: What is the risk of having too many 'Immediate' items?
A: It can overwhelm the business units and lead to 'alert fatigue' or pushback; prioritization is key.
Montance Resource Google Drive
SOC Posture Improvement Report
Q: How does this report format support 'Audit' requirements?
A: It creates a documented trail of identified risks and the organization's response, demonstrating due diligence.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: What is the 'Project Planning' phase's most critical output for a SIEM deployment?
A: A clear definition of the specific problems the SIEM is solving (e.g., compliance vs. threat detection) to prevent scope creep.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: How does 'Log Normalization' directly impact detection logic?
A: It enables correlation rules to work across disparate devices (e.g., Cisco firewall and Windows server) by standardizing fields like IP and Username.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: What is the operational risk of failing to 'Archive' SIEM data?
A: Performance degradation of the active database, leading to slow queries and missed alerts due to ingestion lag.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: Why is 'User Account Management' within the SIEM critical?
A: To ensure that access to sensitive log data is restricted and auditable, preventing insider misuse of the security tool itself.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: How does the 'Lessons Learned' loop improve SIEM content?
A: It uses data from actual incidents to tune existing rules and create new ones, ensuring the SIEM evolves with the threat landscape.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: What implies the need for 'Emergency Content Development'?
A: The realization that new threats (zero-days) require immediate, ad-hoc rules that may bypass standard change control for speed.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: What is the strategic value of 'Time Synchronization' for the SIEM?
A: It is the fundamental requirement for correlation; without it, the sequence of events cannot be determined, making attack reconstruction impossible.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: How does the document suggest managing 'Agent Updates'?
A: By anticipating the need for updates as part of the application lifecycle, ensuring visibility isn't lost when source systems change.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: What is the 'Steering Committee' role in SIEM success?
A: To provide the political cover and authority needed to force system owners to provide logs and support the SIEM initiative.
Montance Resource Google Drive
Sans Successful SIEM Log Management Strategies
Q: How does 'Data Classification' align with SIEM design?
A: It helps determine which logs must be retained for long periods (compliance) versus which can be dropped quickly (operational noise).
Montance Resource Google Drive
Sans Sortingthrunoise
Q: What is the 'Signal-to-Noise' problem in log management?
A: The challenge of finding the few meaningful security events amidst millions of benign operational logs.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: How does 'Baselining' help reduce noise?
A: By understanding what 'normal' looks like, the SOC can filter out standard traffic and only alert on deviations.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: What is the operational benefit of 'Centralized Logging' beyond security?
A: It aids in troubleshooting and operational analytics, making the SIEM valuable to IT operations and increasing their buy-in.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: How does 'Event Correlation' transform raw logs?
A: It combines multiple low-fidelity events (e.g., login fail + huge data transfer) into a single high-fidelity alert.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: What is the role of 'Automation' in handling log volume?
A: It is the only scalable way to parse and filter the massive influx of data; manual review is mathematically impossible.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: Why is 'Log Enrichment' (e.g., GeoIP, User Context) essential?
A: Raw logs often lack context; enrichment adds the 'who, what, where' that allows an analyst to make a quick decision.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: What is the strategy for handling 'Unknown Events'?
A: They should be investigated to determine if they are malicious or benign, and then added to the known baseline or alert logic.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: How does 'Historical Analysis' differ from Real-time Alerting?
A: Historical analysis looks back at stored logs to find long-term patterns (low and slow attacks) that don't trigger real-time thresholds.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: What is the 'Compliance' driver mentioned for logging?
A: Regulations like PCI and SOX often mandate log retention and review, providing the budget justification for the system.
Montance Resource Google Drive
Sans Sortingthrunoise
Q: How does the document suggest 'Prioritizing' alerts?
A: By mapping them to business risk and asset criticality, ensuring the most dangerous threats to the most important assets are seen first.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: What is the 'Steering Committee's' function in SOC governance?
A: To provide strategic direction, resource allocation, and conflict resolution between the SOC and other IT/business units.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: How does the document define 'Situational Awareness' for a SOC Manager?
A: The ability to know the current status of threats, the operational state of defenses, and the progress of active incidents at any given moment.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: What is the 'Staffing Calculation' formula for 24/7 coverage?
A: It typically requires between 8 to 12 full-time equivalents (FTEs) to staff a single 24/7 seat, accounting for shifts, holidays, training, and sick leave.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: What is the 'Analyst Career Path' challenge?
A: The difficulty in retaining talent because there is often no clear progression from Tier 1 analyst to senior roles within the SOC.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: What is the recommended frequency for 'metrics reporting' to different stakeholders?
A: Daily/Weekly for technical operations, Monthly for management, and Quarterly for executive leadership.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: What is the 'Scope Creep' risk in SOC management?
A: The tendency for the SOC to become the 'dumping ground' for general IT tasks (e.g., patching, user administration) that distract from the security mission.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: How should 'Shift Turnover' be conducted?
A: Through a formal meeting and written log where outgoing analysts brief incoming analysts on active incidents and system status.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: What is the 'Authority' requirement for a SOC?
A: The SOC must have the pre-authorized mandate to take containment actions (e.g., isolate a host) without seeking permission during a crisis.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: What is the role of 'Self-Assessment' in SOC management?
A: Regularly testing SOC capabilities via red teaming or table-top exercises to identify gaps.
Montance Resource Google Drive
Sans Designing And Building A SOC Management Fundamentals
Q: What distinguishes 'Leadership' from 'Management' in a SOC?
A: Management focuses on processes and metrics; Leadership focuses on vision, culture, and team morale.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: What is the primary language gap between Security Leaders and C-Level Executives?
A: Security leaders talk about 'Threats and Vulnerabilities', while C-Level executives care about 'Risk and Business Impact'.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: How should a SOC proposal be framed to gain C-Level approval?
A: As a business enabler that protects revenue and brand reputation, rather than just a technical cost center.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: What specific metric is recommended to demonstrate SOC value to the board?
A: The reduction in 'Dwell Time' and its correlation to reduced financial impact of incidents.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: What is the 'Business Impact Analysis' (BIA) role in SOC planning?
A: To identify critical business processes and assets so the SOC can prioritize their protection.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: How can 'Compliance' be used as a lever for SOC funding?
A: By mapping SOC capabilities directly to regulatory requirements (PCI, HIPAA, GDPR) that carry financial penalties for non-compliance.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: What is the 'Quick Win' strategy suggested for new SOCs?
A: Focus on a specific, high-visibility use case (e.g., phishing or ransomware protection) to demonstrate immediate value.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: How should the SOC Manager communicate 'Risk'?
A: Using a heat map or scorecard that shows risk reduction over time, rather than technical jargon.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: What is the danger of 'FUD' (Fear, Uncertainty, Doubt) in C-Level presentations?
A: It creates fatigue and skepticism; data-driven risk assessments are more effective long-term.
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: What is the 'OpEx vs. CapEx' consideration for SOCs?
A: Understanding that building a SOC requires significant ongoing operational expense (staffing), not just an upfront capital expense (buying tools).
Montance Resource Google Drive
Sans C Level Support Ensure High Impact SOC Rollout
Q: How does the paper suggest handling 'Bad News' (incidents) with executives?
A: By being transparent, focusing on the response effectiveness, and presenting a clear plan for preventing recurrence.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: According to the roadmap, what is the very first step in building a SOC?
A: Defining the SOC's Charter and Scope, including its authority and constituency.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: What is the 'Triad' model referenced for SOC maturity?
A: People, Process, and Technology, with an emphasis that Technology should support the other two, not drive them.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: What specific 'Staffing Model' issue is highlighted as a common failure?
A: Underestimating the headcount required for 24/7 coverage, leading to analyst burnout.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: How does the roadmap suggest handling 'Tier 1' analysis?
A: By focusing on triage and validation to filter out false positives before escalating to deeper investigation.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: What is the recommended 'Technology Stack' hierarchy?
A: Log Collection -> SIEM/Analytics -> Incident Response Platform -> Threat Intelligence Platform.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: What is the role of 'Playbooks' in the maturity roadmap?
A: They are essential for ensuring consistent, repeatable responses to common alerts and for enabling future automation.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: How should a SOC measure 'Success' in the early stages?
A: By focusing on 'Visibility' (coverage of assets) and 'Process Adherence' rather than just 'Mean Time to Detect'.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: What is the 'Continuous Improvement' loop?
A: A post-incident review process that feeds lessons learned back into the detection logic and response procedures.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: What capability distinguishes a 'World Class' SOC from an average one?
A: The ability to perform 'Threat Hunting' and 'Proactive Intelligence' rather than just reacting to alerts.
Montance Resource Google Drive
Sans Building World Class Security Operations Center Roadmap
Q: What is the advice regarding 'Outsourcing' in the roadmap?
A: Outsource commodity tasks (like 24/7 eyes-on-glass) but keep strategic capabilities (like incident response and threat intel) in-house.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: What is the primary architectural advantage of 'OpenSOC' compared to traditional SIEMs?
A: It leverages a 'Big Data' architecture (Hadoop/Kafka/Storm) to separate storage from processing, allowing for horizontal scalability.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: What specific technology is used for the real-time message bus in OpenSOC?
A: Apache Kafka.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: How does OpenSOC handle the 'Enrichment' of telemetry data?
A: It uses a real-time streaming topology (likely Storm) to tag data with geo-location, threat intel, and asset information before it is stored.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: What is the 'Analytics Pipeline' described in the presentation?
A: Ingest -> Parse/Normalize -> Enrich -> Store -> Analyze -> Alert.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: What is the role of 'HBase' in the OpenSOC architecture?
A: It serves as the long-term, scalable storage layer for the processed events, allowing for random read/write access.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: How does OpenSOC address the issue of 'Vendor Lock-in'?
A: By being built entirely on open-source technologies (Apache stack), allowing organizations to modify and extend the code without vendor dependencies.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: What is the 'Telemetry' requirement for effective analytics?
A: Full packet capture (PCAP) combined with rich metadata (NetFlow/IPFIX) and endpoint logs.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: What is the recommended approach for 'Data Aging' in this big data model?
A: Using a tiered storage approach: hot data in memory/SSD for immediate analysis, warm data in HBase, and cold data in HDFS archives.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: What is 'Probabilistic Data Structures' used for in OpenSOC?
A: To perform high-speed cardinality estimation (e.g., counting unique IPs) on massive data streams with minimal memory footprint.
Montance Resource Google Drive
RSAconf14 Analytics OpenSOC
Q: What is the goal of the 'Visualization' layer in OpenSOC?
A: To provide analysts with a flexible interface (like Kibana) to query and visualize data without needing to write MapReduce jobs.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: According to NIST SP 800-92, what are the three distinct tiers of log management?
A: Log Generation, Log Analysis and Storage, and Log Monitoring.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: What is the primary operational risk associated with 'Syslog' over UDP?
A: The lack of guaranteed delivery, meaning critical log messages can be lost during network congestion or attacks without the sender knowing.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: How does NIST define 'Log Normalization' in the context of disparate sources?
A: The process of converting each log entry into a standard format with consistent fields (e.g., ensuring all timestamps are UTC and IP addresses are in a standard notation).
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: What specific recommendation is made regarding 'Log Preservation' for legal purposes?
A: Logs must be stored on write-once media (WORM) or cryptographically signed to ensure integrity and admissibility in court.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: What is the recommended strategy for 'Log Rotation' on high-volume systems?
A: Rotate logs based on size (e.g., every 100MB) rather than just time, to prevent file system exhaustion.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: Why does NIST recommend separating 'Operational' logs from 'Security' logs?
A: To allow for different retention policies and access controls, as security logs often contain sensitive data and require stricter integrity protection.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: What is the 'Chain of Custody' requirement for log analysis?
A: Documenting exactly who accessed the logs, when, and for what purpose to maintain their evidentiary value.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: Which specific role is responsible for defining the log retention policy?
A: The Information Security Officer (or equivalent management role), not the system administrator.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: What is the function of a 'Log Relay' or 'Log Aggregator'?
A: To collect logs from multiple sources and forward them to a central repository, often adding a layer of buffering and security.
Montance Resource Google Drive
NIST Sp800 92 Log Management
Q: What is the NIST recommendation for 'Time Synchronization'?
A: All log generating hosts must be synchronized via NTP to a trusted time source to enable accurate event correlation.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: How did the overall security operations maturity change from 2014 to 2015 according to the report?
A: It declined year-over-year, dropping from a global median of 2.21 to an estimated lower figure (implied challenge in keeping pace).
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: What specific trend explains the decline in SOC maturity despite increased investment?
A: The rapid transformation of IT to hybrid models (cloud, mobile, IoT) combined with the professionalization of the attacker community outpaced defensive maturity.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: Which capability gap was identified as the most critical 'missing link' in 2015?
A: The lack of 'Hunt Teaming' capabilities to proactively identify threats that evaded automated detection.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: What is the '5th Generation SOC' (5G/SOC) characterized by?
A: A shift towards analytics, big data, intelligence-driven methodology, information sharing, and a focus on the human adversary.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: In the maturity model used, what level represents a 'Defined' process?
A: Level 3, where security operations are proactive, repeatable, and documented.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: Which industry vertical showed the highest maturity in the 2016 report?
A: The Technology sector, often surpassing Finance in certain operational areas.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: What is the recommended ratio of 'People' vs. 'Technology' investment for a mature SOC?
A: The report suggests a balanced approach but highlights that many organizations over-invest in technology while under-investing in the skilled people needed to run it.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: How does the report define the 'Detection Deficit'?
A: The time delta between the initial compromise of an asset and the discovery of that compromise.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: What specific metric does the report suggest for measuring 'Business Alignment'?
A: The percentage of critical business assets that are actively monitored by the SOC.
Montance Resource Google Drive
HP State Of Security Operations 2016
Q: What is the primary recommendation for organizations stuck at Maturity Level 1?
A: Focus on establishing a formal mandate, defining core processes, and achieving basic visibility before purchasing advanced analytics tools.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: How does SecureWorks define 'Total Cost of Ownership' (TCO) for a SOC?
A: It includes not just hardware and software costs, but also facility costs, power/cooling, recruitment, training, benefits, and ongoing tuning/maintenance.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: What is the 'economies of scale' argument for MSSPs?
A: MSSPs can spread the cost of expensive threat intelligence, advanced tools, and 24/7 staffing across hundreds of customers, lowering the per-customer cost.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: What specific 'Hidden Cost' of in-house SIEM does the paper highlight?
A: The continuous effort required to parse new log sources, create new correlation rules, and tune out false positives.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: How does the paper address 'Staff Attrition'?
A: It argues that MSSPs are better equipped to handle turnover because they have a larger pool of analysts and established training pipelines.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: What is the 'Capital Expense' (CapEx) vs. 'Operating Expense' (OpEx) argument?
A: MSSPs allow organizations to shift security costs to a predictable OpEx model, avoiding large upfront CapEx investments in hardware and software.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: What is the benefit of 'Global Visibility' offered by an MSSP?
A: The ability to see attacks across a diverse customer base and proactively protect other customers from the same threat.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: How does SecureWorks counter the 'Loss of Control' objection?
A: By offering customer portals that provide transparency into the alerts, tickets, and actions taken by the MSSP.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: What is the 'Time to Value' comparison?
A: An MSSP can be operational in weeks, whereas building a mature in-house SOC can take 12-24 months.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: What is the '24x7x365' staffing challenge cited?
A: The difficulty for most organizations to find and keep 10-12 qualified people willing to work nights, weekends, and holidays.
Montance Resource Google Drive
Secureworks Going The MSSp Route TCO Issues
Q: What is the 'Focus on Core Competency' argument?
A: That for most non-security companies, building a SOC is a distraction from their primary business mission.
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: What is the 'Hybrid SOC' model advocated in the webcast?
A: Retaining core incident response and threat hunting expertise in-house while outsourcing 24/7 monitoring and log collection to an MSSP.
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: What is the primary hidden cost of an 'In-house Only' SOC?
A: The high cost of recruiting, training, and retaining skilled staff, and the overhead of managing 24/7 shifts.
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: What is the major downside of 'Fully Outsourced' security?
A: The lack of business context and the potential for a 'black box' service where the organization loses visibility into its own data.
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: What criteria should be used to select an MSSP?
A: Their ability to integrate with your specific technology stack, their SLAs for detection (not just notification), and data ownership policies.
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: What is the 'Co-Managed' SIEM approach?
A: A model where the organization owns the SIEM license and data, but the MSSP manages the infrastructure and provides the first layer of monitoring.
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: When is 'Outsourcing' the best option?
A: When the organization lacks the scale or budget to sustain a minimum effective team (usually <5 security staff).
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: What is the 'Data Sovereignty' consideration?
A: Ensuring that an outsourced provider keeps your data within required legal jurisdictions (e.g., GDPR requirements).
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: How does the webcast suggest measuring MSSP performance?
A: Through regular 'purple team' exercises where you simulate attacks to test if the provider detects and reports them according to the SLA.
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: What is the 'Vendor Lock-in' risk with MSSPs?
A: The difficulty of migrating historical logs and knowledge if you decide to switch providers or bring the function in-house.
Montance Resource Google Drive
Sans Webcast Designing And Building A SOC In House Vs Out Sourcing
Q: What is the '24/7' fallacy?
A: The assumption that bad things only happen at night; often, the most critical need for expertise is during business hours when users are active.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is the main benefit of an MSSP?
A: Efficiency, Scalability, and Intelligence.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is 'Co-Management'?
A: Sharing responsibility between client and MSSP.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is the 'Cost of Failure'?
A: The financial impact of a breach.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is '24x7 Monitoring'?
A: Continuous surveillance of the environment.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is the value of 'Global Threat Intelligence'?
A: Seeing attacks across many customers.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is 'Log Retention'?
A: Storing logs for compliance.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is 'Portal Access'?
A: Visibility into the MSSP's work.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is 'SLA'?
A: Service Level Agreement.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is 'Device Management'?
A: Managing firewalls, IDS, etc.
Montance Resource Google Drive
Solutionary Business Case For MSS 1100wp
Q: What is the 'ROI' of MSSP?
A: Cost savings vs internal staffing.
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is Report #1?
A: Attempts to gain access through existing accounts (Failed Logins).
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is Report #2?
A: Failed file access attempts (Access Denied).
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is Report #3?
A: Unsuccessful attempts to gain access through non-existent accounts.
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is Report #4?
A: Systems most vulnerable to attack (Scan logs).
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is Report #5?
A: Suspicious or unauthorized network traffic patterns.
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is the goal of these reports?
A: To identify suspect activity with low false positives.
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is 'Brute Force'?
A: Repeated login attempts.
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is 'Privilege Escalation'?
A: Gaining higher access rights.
Montance Resource Google Drive
Sans Top5 Logreports
Q: What is 'Data Exfiltration'?
A: Unauthorized data transfer.
Montance Resource Google Drive
Sans Top5 Logreports
Q: Who contributed to this list?
A: SANS community consensus.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is the 'HP Attack Life Cycle'?
A: A modified Kill Chain model.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'Reconnaissance'?
A: Gathering info on the target.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'Weaponization'?
A: Creating the exploit.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'Delivery'?
A: Sending the exploit to the target.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'Exploitation'?
A: Triggering the vulnerability.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'Installation'?
A: Installing malware/backdoor.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'C2'?
A: Command and Control.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'Actions on Objectives'?
A: Stealing data or causing damage.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'Lateral Movement'?
A: Moving between systems.
Montance Resource Google Drive
HP Kill Chain Use Case
Q: What is 'Persistence'?
A: maintaining access.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is the first step in building a SOC?
A: Define the Mission and Scope.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What are the three pillars?
A: People, Process, Technology.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is 'Tier 1'?
A: Triage and basic investigation.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is 'Tier 2'?
A: Deep analysis and incident response.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is 'Tier 3'?
A: Advanced threat hunting and forensics.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is a 'Playbook'?
A: Standardized procedures for incidents.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is 'SIEM'?
A: The core technology for aggregation.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is 'Use Case Development'?
A: Creating rules to detect threats.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is 'Shift Work'?
A: 24x7 staffing rotations.
Montance Resource Google Drive
Cisco How To Build SOC
Q: What is 'Metrics'?
A: Measuring SOC performance.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What is the core argument for building an internal SOC vs. outsourcing?
A: The need for deep business context and the ability to respond immediately to incidents that threaten critical assets.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What are the five key functions of a SOC?
A: Event Management, Incident Management, Problem Management, Change Management, and Knowledge Management.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What is the 'Event Management' process?
A: The automated collection, normalization, and correlation of logs to generate alerts.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What distinguishes 'Incident Management' from Event Management?
A: Incident management is the human process of investigating and resolving the alerts generated by event management.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What is the 'Problem Management' function?
A: Identifying the root cause of recurring incidents to prevent them from happening again (e.g., fixing a vulnerable configuration).
Montance Resource Google Drive
HP Building A Successful SOC
Q: How does 'Knowledge Management' support the SOC?
A: By maintaining a knowledge base of known errors, threat intel, and response procedures to speed up future investigations.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What is the 'Mission Statement' of a SOC?
A: A clear definition of what the SOC protects, its authority, and its service hours.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What is the recommended physical layout for a SOC?
A: A secure room with wall-mounted displays (video wall), tiered seating for analysts, and a separate 'war room' for crisis management.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What is the role of 'Shift Handoff'?
A: Ensuring continuity of operations by formally transferring knowledge of active incidents between shifts.
Montance Resource Google Drive
HP Building A Successful SOC
Q: What is the 'Metrics' focus in this paper?
A: Operational metrics (volume, time) and Business metrics (risk reduction, value delivered).
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: What is the primary objective of the PDIS certification?
A: To verify that a service provider has the capability to detect security incidents affecting critical information systems (CII) in compliance with French law.
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: What does the acronym 'PDIS' stand for?
A: Prestataires de Dction des Incidents de SritSecurity Incident Detection Service Providers).
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: What are the two main types of data that a PDIS is expected to collect?
A: Technical logs (from systems, networks, applications) and Security alerts (from detection probes).
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: What is the maximum duration for retaining technical logs according to the PDIS requirements?
A: Typically 1 year (or as defined by the specific service level agreement, but bounded by regulatory limits).
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: What specific role must be separated from the 'Analyst' role in a PDIS?
A: The 'Administrator' role of the detection service itself, to prevent tampering with evidence.
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: What is the 'Qualification' process mentioned?
A: A formal evaluation by a certified audit provider (LSTI, etc.) to ensure the PDIS meets all ANSSI requirements.
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: Does the PDIS regulation apply to all companies in France?
A: No, it is primarily targeted at Operators of Vital Importance (OIV) and Critical Information Infrastructure (CII).
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: What physical security requirement is mandated for the SOC premises?
A: Strict access control, video surveillance, and separation of the SOC zone from other business areas.
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: What is the requirement regarding 'Data Sovereignty' for PDIS?
A: Data collected from critical systems must be stored and processed within France or a trusted jurisdiction.
Montance Resource Google Drive
ANSSI French Regulation For SOC PDIS Referentiel V1.0 En
Q: How must a PDIS handle 'False Positives'?
A: They must have a documented process for tuning detection rules to minimize false positives while maintaining detection efficacy.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What defines a '1st Generation SOC' (1975-1995)?
A: Focus on physical security and mainframe access control; minimal network monitoring.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What characterized the '2nd Generation SOC' (1996-2001)?
A: The era of the perimeter firewall and early Intrusion Detection Systems (IDS); focus on malware outbreaks.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What major shift occurred in the '3rd Generation SOC' (2002-2006)?
A: The rise of botnets and cybercrime led to the adoption of SIEM for log correlation and compliance reporting.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What defines the '4th Generation SOC' (2007-2012)?
A: Focus on APTs, data exfiltration, and the integration of diverse data sources beyond just security logs (e.g., NetFlow).
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What is the key differentiator of the '5th Generation SOC' (5G/SOC)?
A: Intelligence-driven operations, big data analytics, and a focus on the human adversary rather than just malware.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What technology enables the 5G/SOC?
A: Big Data platforms (Hadoop), advanced analytics, and automated threat intelligence sharing.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: How does the 5G/SOC approach 'Context'?
A: It enriches alerts with business context, user identity, and threat intelligence to prioritize response.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What is the role of 'Machine Learning' in the 5G/SOC?
A: To detect anomalies in user behavior and network traffic that do not match known signatures.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What is the 'Proactive' shift in 5G/SOC?
A: Moving from waiting for alerts to actively hunting for threats in the environment.
Montance Resource Google Drive
HP 5g SOC SOC Generation
Q: What is the 'Information Sharing' component?
A: Automated exchange of Indicators of Compromise (IOCs) with industry peers and government agencies.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: What is the main purpose of this Carnegie Mellon report?
A: To provide guidance and a template for organizations creating a Request for Proposal (RFP) for Managed Security Services (MSS).
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: What distinction does the report make between 'Management' and 'Monitoring'?
A: Management involves configuration and maintenance of devices; Monitoring involves analyzing alerts and logs for threats.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: What is a critical 'Exit Strategy' consideration mentioned?
A: Ensuring the contract defines how data (logs, configurations) will be returned to the client upon termination.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: What financial metric should be requested in an RFP to assess vendor stability?
A: Audited financial statements for the past 3 years.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: What is the 'SLA' warning regarding 'Time to Notify'?
A: That 'Time to Notify' is useless if it starts only after the vendor 'validates' the alert; the clock should start at detection.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: Why does the report suggest asking about 'Analyst Turnover'?
A: High turnover rates at an MSSP can indicate poor working conditions and a lack of experienced staff handling your data.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: What is the 'Co-Management' model described?
A: A hybrid approach where the client retains some administrative rights to the security devices managed by the MSSP.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: What specific question should be asked regarding 'Portal Access'?
A: Whether the client has real-time, read-write, or read-only access to the same console the MSSP analysts use.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: How does the report address 'Customization'?
A: It warns that excessive customization can lead to higher costs and support challenges; standard services are cheaper but less flexible.
Montance Resource Google Drive
Carnegie Mellon University RFP Ex Outsourcing Managed Security Services
Q: What is the 'Vendor Neutrality' criterion?
A: Whether the MSSP requires you to buy specific hardware vendors or can support a heterogeneous environment.
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is Error #1 in log collection?
A: Collecting everything without a plan (The 'Hoarder' mentality).
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is the consequence of Error #1?
A: Storage costs explode, and finding relevant data becomes impossible due to noise.
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is Error #2?
A: Ignoring the 'Chain of Custody'. Logs must be legally admissible.
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is Error #3?
A: Collecting logs but never looking at them (Write-only memory).
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is Error #4?
A: Relying solely on default logging configurations (which are often insufficient).
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is Error #5?
A: Not synchronizing time (NTP) across all devices.
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is the impact of unsynchronized time?
A: It makes event correlation impossible and ruins forensic timelines.
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is Error #6?
A: Failing to secure the logs (allowing attackers to delete their tracks).
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is the recommendation for 'Log Format'?
A: Standardize log formats (e.g., Syslog, CEF) to simplify parsing.
Montance Resource Google Drive
Log Collection Key Errors To Avoid
Q: What is the final error mentioned?
A: Not having a retention policy (keeping logs too long or not long enough).
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: What is the 'River Delta' analogy used in this paper?
A: Comparing the flow of data in an enterprise to a river; the SOC needs to filter the 'sediment' (noise) to find the 'gold' (threats).
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: What is the primary limitation of 'Signature-based' detection?
A: It can only detect known threats; it fails against zero-day attacks and novel techniques.
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: How does 'Behavioral Analytics' differ from signature detection?
A: It establishes a baseline of normal activity and flags deviations (anomalies) as potential threats.
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: What is the role of 'Big Data' in security analytics?
A: It allows for the storage and processing of massive volumes of historical data for long-term trend analysis and hunting.
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: What is 'User and Entity Behavior Analytics' (UEBA)?
A: Focusing analytics on the actions of users and devices (entities) to detect insider threats and compromised accounts.
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: What is the 'DNS Analytics' use case?
A: Detecting command and control (C2) traffic and data exfiltration by analyzing DNS query patterns (e.g., DGA domains).
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: What is 'Peer Group Analysis'?
A: Comparing a user's behavior to that of their peers (e.g., 'other accountants') to identify anomalies.
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: Why is 'Context' critical for analytics?
A: Without context (asset value, user role), an anomaly is just a statistical outlier; context turns it into a prioritized alert.
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: What is the 'Feedback Loop' in analytics?
A: Analysts validating alerts to train the machine learning models, improving accuracy over time.
Montance Resource Google Drive
HP Vision Cyber Security Analytics
Q: What is the vision for the 'Future SOC'?
A: A highly automated, intelligence-driven center where analytics handle the bulk of detection and analysts focus on complex investigations.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: What are the five levels of the IT Data Management Maturity Scale?
A: Level 1: Chaos, Level 2: Reactive, Level 3: Proactive, Level 4: Service, Level 5: Value.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: What characterizes Level 1 (Chaos)?
A: Ad-hoc processes, no central repository, data silos, and high operational risk.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: What characterizes Level 3 (Proactive)?
A: Defined processes, centralized data management, automated reporting, and predictable service levels.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: What is the focus of Level 5 (Value)?
A: Data is treated as a strategic asset; analytics drive business innovation and competitive advantage.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: What is the 'tipping point' between Level 2 and Level 3?
A: The implementation of formal governance and standardized tools.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: Which level introduces 'Service Level Agreements' (SLAs)?
A: Typically Level 3 or 4.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: What is the primary goal at Level 2 (Reactive)?
A: Stabilizing operations and achieving basic visibility.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: What technology is typically introduced at Level 3?
A: Centralized Log Management or SIEM.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: How does 'Cost' change across the maturity scale?
A: It shifts from 'unpredictable/high operational cost' to 'optimized investment/high value return'.
Montance Resource Google Drive
IT Data Management Maturity Scale
Q: What represents the highest maturity in data usage?
A: Predictive analytics and automated decision-making.
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: What are the three primary components of HP's SOC framework?
A: People, Process, and Technology.
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: What is the recommended 'Analyst-to-Device' ratio?
A: It varies by complexity, but generally one analyst can monitor a specific volume of events; over-loading leads to missed alerts.
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: What is the 'Tiered' staffing model described?
A: Tier 1 (Triage), Tier 2 (Investigation/Response), and Tier 3 (Advanced Forensics/Hunt).
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: What is the importance of 'Use Cases' in building a SOC?
A: They define exactly what the SOC is monitoring for (e.g., 'Phishing', 'Data Exfiltration') and drive the technology configuration.
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: How does HP define 'Situational Awareness'?
A: The ability to correlate technical events with business criticality to understand the true impact of an incident.
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: What is the role of the 'SOC Manager'?
A: To oversee operations, manage the budget, ensure SLA compliance, and report to executive leadership.
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: What technology is central to the SOC according to this paper?
A: ArcSight SIEM (Security Information and Event Management).
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: What is the 'Hybrid' model mentioned?
A: Combining internal SOC capabilities with managed security services for specific functions (e.g., after-hours monitoring).
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: Why is 'Career Path' important for SOC analysts?
A: To prevent burnout and turnover; analysts need to see a progression from Tier 1 to Tier 3 or management.
Montance Resource Google Drive
HP Building A Successful SOC 2014
Q: What metric is suggested to measure 'Efficiency'?
A: The number of incidents closed per analyst per shift, balanced against the quality of the investigation.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What is the primary purpose of the 'SOC Stock Metrics' document?
A: To provide a catalog of standard metrics for measuring SOC performance using ArcSight.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What metric is used to measure 'Detection Efficiency'?
A: The ratio of events to alerts to confirmed incidents.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What is the 'Rule Firing Rate'?
A: The frequency with which specific correlation rules are triggered.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: How is 'False Positive Rate' calculated?
A: The percentage of alerts that are determined to be non-malicious after investigation.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What does 'Time to Triage' measure?
A: The average time from alert generation to initial analyst review.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What is the 'Device Reporting' metric?
A: The percentage of devices successfully sending logs to the SIEM.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What is the 'EPS' metric?
A: Events Per Second - a measure of log volume and system load.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What is the value of 'Analyst Workload' metrics?
A: To identify staffing needs and prevent burnout by tracking cases per analyst.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What is 'Mean Time to Resolution' (MTTR)?
A: The average time it takes to close an incident.
Montance Resource Google Drive
HP ArcSight SOC Metrics
Q: What is the 'Top Talkers' metric?
A: Identifying the hosts generating the most network traffic or log volume.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: What is the primary vulnerability discussed regarding 2G/3G/4G networks?
A: The lack of mutual authentication in older protocols (2G) allowing for impersonation.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: What is an 'IMSI Catcher'?
A: A device that mimics a legitimate cell tower to intercept mobile traffic and track users.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: How does a 'Downgrade Attack' facilitate eavesdropping?
A: It forces a 4G/LTE device to connect to a less secure 2G network where encryption is weak or nonexistent.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: What is 'A5/1'?
A: The encryption algorithm used in GSM (2G) which has been cryptographically broken.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: What is 'Femtocell' exploitation?
A: Compromising a small, home-based cellular base station to intercept traffic or gain access to the carrier network.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: What is the significance of 'SS7' vulnerabilities?
A: They allow attackers to intercept calls and SMS messages, and track locations across global networks.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: Why is 'air interface' encryption insufficient?
A: It only protects traffic between the device and the tower; it does not protect data in the carrier's backhaul network.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: What tool is mentioned for cellular network analysis?
A: OpenBTS (Open Base Transceiver Station).
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: What is the risk of 'pre-shared keys' in SIM cards?
A: If the key database is compromised (as in the Gemalto hack), encryption can be bypassed.
Montance Resource Google Drive
Cellulareavesdropping Sd
Q: What mitigation is suggested for high-risk users?
A: Using end-to-end encrypted voice and messaging apps (e.g., Signal) instead of standard cellular services.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What is the main topic of the Android Code Inspection presentation?
A: Static and dynamic analysis of Android applications for security vulnerabilities.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What tool is recommended for decompiling Android APKs?
A: JADX (or dex2jar + JD-GUI).
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What is the 'AndroidManifest.xml' file?
A: A critical file that defines the app's structure, permissions, and components.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What is 'Exported Activity' vulnerability?
A: An activity that can be launched by other apps, potentially bypassing security checks.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What is 'Hardcoded Secrets' analysis?
A: Searching the code for API keys, passwords, or cryptographic keys.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What tool is used for 'Dynamic Instrumentation'?
A: Frida or Xposed Framework.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What is 'Certificate Pinning' bypass?
A: A technique to force an app to accept a proxy's certificate for traffic interception.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What is 'Insecure Data Storage'?
A: Storing sensitive data (like credentials) in plaintext in SharedPreferences or SQLite databases.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What is 'Drozer'?
A: A comprehensive security assessment framework for Android.
Montance Resource Google Drive
Pentest Hackfest Androidcodeinspection
Q: What is the risk of 'WebView' vulnerabilities?
A: They can allow Cross-Site Scripting (XSS) or access to local files from a web page.
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the central theme of the Crowley SOC Summit presentation?
A: The evolution of SOCs and the need to adapt to mobile and cloud threats.
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the 'OODA Loop' applied to SOCs?
A: Observe, Orient, Decide, Act - a cycle for rapid incident response.
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the 'SOC Triad' defined in this presentation?
A: Command Center, Network Security Monitoring, and Threat Intelligence.
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the 'Analyst Burnout' factor?
A: The high turnover rate caused by repetitive work and alert fatigue.
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the recommended 'Shift Length' for SOC analysts?
A: Ideally 8-10 hours to maintain alertness, avoiding 12-hour shifts where possible.
Montance Resource Google Drive
Crowley SOC Summit
Q: How should 'Metrics' be used in a SOC?
A: To drive improvement and justify budget, not just to report activity counts.
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the 'Fusion Center' model?
A: Integrating cyber threat intelligence with physical security and fraud detection.
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the role of 'Active Defense'?
A: Proactively engaging adversaries to disrupt their attacks (e.g., honeypots, annoyance).
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the 'Skills Gap' solution proposed?
A: Internal training and mentorship programs rather than relying solely on hiring 'unicorns'.
Montance Resource Google Drive
Crowley SOC Summit
Q: What is the importance of 'Business Alignment'?
A: Ensuring SOC activities directly support the organization's mission and risk appetite.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the context of the Tokyo SOC Presentation?
A: A presentation given at a SANS event in Tokyo regarding SOC best practices.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the 'Japanese Cultural Context' discussed?
A: The emphasis on consensus and hesitation to report bad news, which can hinder incident response.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the 'Galapagos Effect' in Japanese IT?
A: The tendency for Japanese technology to evolve in isolation, creating unique legacy challenges.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the recommendation for 'Cross-Cultural Communication'?
A: Clear, data-driven reporting that avoids ambiguity.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the 'Talent Pipeline' challenge in Japan?
A: A severe shortage of cybersecurity professionals due to lack of academic programs.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the role of 'External Advisors'?
A: To provide an objective perspective and validate internal findings.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the 'Visualization' strategy?
A: Using dashboards to bridge the language gap and show status clearly.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the 'Community Sharing' initiative?
A: Encouraging Japanese companies to share threat intel (e.g., via ISACs).
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What tool is suggested for 'Language Agnostic' analysis?
A: Network traffic analysis and visualizing flows.
Montance Resource Google Drive
Tokyo SOC Presentation
Q: What is the 'Kaizen' approach to SOCs?
A: Continuous, incremental improvement of processes.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: What type of malware is 'HummingBad'?
A: An Android rootkit and adware.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: Who is attributed as the creator of HummingBad?
A: Yingmob, a Chinese advertising analytics agency.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: What is the primary infection vector?
A: Drive-by downloads from malicious websites.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: How does HummingBad achieve persistence?
A: By attempting to root the Android device.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: What is the estimated number of infected devices mentioned?
A: Over 10 million devices globally.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: What is the revenue model for HummingBad?
A: Generating fraudulent ad revenue and installing fraudulent apps.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: What is 'silent installation'?
A: Installing apps in the background without user consent or interaction.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: What specific component allows it to root devices?
A: It carries a library of known exploits (e.g., Framaroot) to try against the device.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: How does it handle 'Command and Control' (C2)?
A: It communicates with C2 servers to receive tasks and upload device data.
Montance Resource Google Drive
Hummingbad Malware Cc 1000
Q: What is the significance of the 'right_core' component?
A: It is the main malicious payload that decrypts and executes other modules.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is Step 1 of the Top 8 Steps for Mobile Security?
A: Enforce Device Passcode Authentication.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is Step 2?
A: Monitoring Mobile Device Access and Use.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is Step 3?
A: Patching Mobile Devices.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is Step 4?
A: Prohibit Unapproved Third-Party Application Stores.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is Step 5?
A: Control Physical Access.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is Step 6?
A: Evaluate Application Security Compliance (App Assessment).
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is Step 7?
A: Prepare an Incident Response Plan for Lost or Stolen Mobile Devices.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is Step 8?
A: Implement Management and Operational Support.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is the focus of 'App Assessment' in this document?
A: Verifying that apps do not leak data or introduce vulnerabilities.
Montance Resource Google Drive
Top8stepsformobile Appassessmentfocus Orlando
Q: What is the 'Containerization' strategy?
A: Isolating corporate data/apps from personal data on the device.
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What was the primary focus of the 2017 SOC Summit Survey Deep Dive?
A: Analyzing the results of the SANS SOC survey with a focus on 'boots on the ground' reality.
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What was the most common 'Pain Point' reported by analysts?
A: Lack of visibility and excessive noise (false positives).
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What percentage of SOCs reported having 'Full Visibility'?
A: Less than 20%.
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What technology was rated highest for 'Value'?
A: SIEM and Endpoint Detection and Response (EDR).
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What is the 'so what' factor in metrics?
A: The need for metrics to tell a story and drive decision-making, not just show numbers.
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What was the trend regarding 'Outsourcing'?
A: A shift towards hybrid models where Tier 1 is outsourced but Tier 2/3 remains in-house.
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What is the 'Analyst to Device' ratio discussed?
A: A metric attempting to define optimal staffing levels based on infrastructure size.
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What is the 'Skill Shortage' impact?
A: Increasing reliance on automation and managed services.
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What is the recommendation for 'Use Case' management?
A: Regularly reviewing and retiring ineffective use cases.
Montance Resource Google Drive
SOC Summit Survey Deep Dive
Q: What is the 'Threat Hunting' maturity level?
A: Most organizations were still in the early stages (ad-hoc) of threat hunting.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What is the title of the SANS 2017 SOC Survey?
A: Future SOC: SANS 2017 Security Operations Center Survey.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What was the top barrier to SOC excellence identified in 2017?
A: Lack of visibility into the network and endpoints.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What percentage of SOCs reported being 'fully defined and optimized'?
A: Only 14% of respondents.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What technology was cited as the 'most critical' for future SOCs?
A: Security Automation and Orchestration (SOAR).
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What percentage of SOCs use a 'Hybrid' staffing model (Internal + MSSP)?
A: 33% of respondents use a hybrid model.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What is the most common metric used to measure SOC performance?
A: Number of incidents handled.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What percentage of SOCs have a dedicated 'Threat Hunting' team?
A: 28% of respondents reported having a dedicated hunting team.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What is the 'SANS SOC Maturity Model' mentioned?
A: A 5-level model ranging from 'Non-Existent' to 'Optimized'.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What is the primary driver for SOC evolution?
A: The increasing sophistication of attacks and the failure of prevention-only strategies.
Montance Resource Google Drive
Future SOC Sans 2017 Survey
Q: What percentage of SOCs integrate Threat Intelligence into their SIEM?
A: 62% of respondents.
Montance Resource Google Drive
Tokyo Commnight V001
Q: What event was 'Tokyo CommNight v001' prepared for?
A: A community networking night in Tokyo for security professionals.
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is the main topic of discussion?
A: Building and Maturing Security Operations Centers.
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is the 'Community Defense' concept?
A: Sharing threat intelligence and best practices between organizations to improve collective security.
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is the role of 'Open Source Tools' in this presentation?
A: Encouraged as a cost-effective way to build capability (e.g., ELK stack, Zeek).
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is the 'Talent Gap' issue in Japan?
A: A severe shortage of qualified cybersecurity professionals in the Japanese market.
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is 'Purple Teaming'?
A: Collaboration between Red Teams (attackers) and Blue Teams (defenders) to improve detection.
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is the recommended frequency for 'Tabletop Exercises'?
A: At least quarterly.
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is the 'Insider Threat' focus?
A: Detecting malicious or negligent insiders using user behavior analytics (UBA).
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is the 'Language Barrier' challenge?
A: Difficulty in consuming English-language threat intel and documentation in Japanese organizations.
Montance Resource Google Drive
Tokyo Commnight V001
Q: What is the 'Call to Action'?
A: To build a stronger local community for information sharing.
Montance Resource Google Drive
Use Case Development 2017
Q: What is a 'Use Case' in the context of this presentation?
A: A specific condition or set of conditions that the SOC is monitoring for to detect a threat.
Montance Resource Google Drive
Use Case Development 2017
Q: What is the 'Use Case Lifecycle'?
A: Development, Implementation, Tuning, and Retirement.
Montance Resource Google Drive
Use Case Development 2017
Q: What is the 'MaGMA' framework reference?
A: Management, Growth, Metrics, and Assessment - a framework for use cases.
Montance Resource Google Drive
Use Case Development 2017
Q: What is the 'False Positive Rate' target?
A: Ideally less than 10% for high-fidelity alerts.
Montance Resource Google Drive
Use Case Development 2017
Q: What is the 'Data Source' requirement?
A: You cannot detect what you do not log; ensure necessary logs are ingested.
Montance Resource Google Drive
Use Case Development 2017
Q: What is the 'Logic' component of a use case?
A: The specific correlation rule or query used to trigger the alert.
Montance Resource Google Drive
Use Case Development 2017
Q: What is the 'Response' component?
A: The defined playbook or procedure for handling the alert once triggered.
Montance Resource Google Drive
Use Case Development 2017
Q: What is 'testing' in use case development?
A: Simulating the attack to ensure the use case triggers as expected.
Montance Resource Google Drive
Use Case Development 2017
Q: What is 'Tuning'?
A: Adjusting thresholds and whitelists to reduce noise.
Montance Resource Google Drive
Use Case Development 2017
Q: What is the 'Documentation' requirement for use cases?
A: Every use case must have a document describing its purpose, logic, and response procedures.
Montance Resource Google Drive
Osaka SOC Brief
Q: What specific date was the Osaka SOC Brief presented?
A: October 2018.
Montance Resource Google Drive
Osaka SOC Brief
Q: Who is the presenter of the Osaka SOC Brief?
A: Christopher Crowley.
Montance Resource Google Drive
Osaka SOC Brief
Q: What is the '10 Strategies' reference in this presentation?
A: Refers to the MITRE 'Ten Strategies of a World-Class Cybersecurity Operations Center'.
Montance Resource Google Drive
Osaka SOC Brief
Q: What is the 'Detection Deficit' mentioned?
A: The time gap between when an intrusion occurs and when it is detected.
Montance Resource Google Drive
Osaka SOC Brief
Q: What is the recommended approach to 'Log Retention'?
A: Retain logs for at least 1 year to support historical analysis and compliance.
Montance Resource Google Drive
Osaka SOC Brief
Q: What is 'Process Consistency'?
A: Ensuring that every analyst handles the same type of alert in the same way.
Montance Resource Google Drive
Osaka SOC Brief
Q: What is the 'Analyst Burnout' rate discussed?
A: High turnover due to repetitive tasks and high stress; automation is the proposed solution.
Montance Resource Google Drive
Osaka SOC Brief
Q: What is the role of 'Use Cases' in this brief?
A: To define exactly what the SOC is looking for and how to respond.
Montance Resource Google Drive
Osaka SOC Brief
Q: What is the 'OODA Loop' application here?
A: Using the OODA loop to speed up decision making during incident response.
Montance Resource Google Drive
Osaka SOC Brief
Q: What is the advice on 'Tool Sprawl'?
A: Consolidate tools where possible and ensure they integrate well.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What is the main theme of the Osaka SOC Brief?
A: Common Sense SOC Tactics & Strategies: Advice on Overcoming Challenges.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What are the three main challenges identified for Osaka-based SOCs?
A: Language barriers in threat intel, staffing shortages, and integration of legacy systems.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What is the recommended strategy for handling 'Alert Fatigue'?
A: Implementing better correlation rules and utilizing automation for low-level alerts.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What role does 'Cultural Context' play in Japanese SOCs?
A: High-context communication style requires distinct reporting structures compared to Western SOCs.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What specific tool is recommended for 'Network Visibility' in this brief?
A: Zeek (formerly Bro) or similar open-source NIDS.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What is the 'Fusion Center' concept discussed?
A: Combining SOC, CERT, and Threat Intel functions into a single collaborative unit.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What metrics are suggested for measuring SOC effectiveness in this region?
A: Time to Triage and Time to Qualify incidents.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What is the advice regarding 'Vendor Reliance'?
A: Avoid over-reliance on a single vendor; build internal capability to validate vendor findings.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: How should 'Shift Handovers' be managed?
A: Using structured, written logs and overlap periods for verbal briefing.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Osaka
Q: What is the 'Continuous Improvement' cycle mentioned?
A: Plan-Do-Check-Act (PDCA) applied to SOC processes.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What distinguishes the Singapore SOC landscape according to this presentation?
A: High regulatory compliance pressure (MAS TRM) and a strong focus on government-led initiatives.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What is the 'Smart Nation' initiative's impact on SOCs?
A: Increased need for OT/IoT security monitoring and integration with traditional IT SOCs.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What is the primary recommendation for 'Talent Retention' in Singapore?
A: Providing clear career paths, training budgets, and rotation opportunities.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What is 'Threat Hunting' defined as in this brief?
A: The proactive search for adversaries who have evaded preventative controls.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What framework is recommended for Singaporean financial institutions?
A: MAS TRM Guidelines (Monetary Authority of Singapore Technology Risk Management).
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What is the role of 'Government CSIRTs' like SingCERT?
A: To provide national-level threat intelligence and coordination for critical infrastructure.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What is the 'Active Defense' strategy mentioned?
A: Engaging adversaries within your own network to consume their resources and gather intelligence (e.g., honeypots).
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What is the recommended ratio of Tier 1 to Tier 2 analysts?
A: Approximately 4:1 or 5:1 depending on automation levels.
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: How is 'Cloud Security' addressed in this brief?
A: By recommending cloud-native monitoring tools and integration with cloud provider APIs (e.g., AWS CloudTrail).
Montance Resource Google Drive
CIRT CERT CSIRT SOC Singapore
Q: What is the 'Cyber Drill' recommendation?
A: Conducting regular, realistic attack simulations to test people and processes.
Montance Resource Google Drive
SOC Brief
Q: What is the subtitle of the 'SOC Brief' presentation?
A: Common Sense SOC Tactics & Strategies: Advice on Overcoming Challenges.
Montance Resource Google Drive
SOC Brief
Q: What are the 'Three Pillars' of a SOC defined here?
A: People, Process, and Technology.
Montance Resource Google Drive
SOC Brief
Q: What is the 'Force Multiplier' concept?
A: Using technology (automation) to amplify the capabilities of the human staff.
Montance Resource Google Drive
SOC Brief
Q: What is the primary goal of 'Triage'?
A: To quickly determine if an alert is a true positive (incident) or false positive (noise).
Montance Resource Google Drive
SOC Brief
Q: What is the 'Pyramid of Pain'?
A: A conceptual model showing the difficulty for an attacker to change their TTPs vs. simple indicators like IPs.
Montance Resource Google Drive
SOC Brief
Q: What is the recommendation for 'Documentation'?
A: Document processes as they are performed, not as a separate academic exercise.
Montance Resource Google Drive
SOC Brief
Q: What is the 'Shift Left' concept in SOCs?
A: Moving detection and prevention earlier in the attack lifecycle.
Montance Resource Google Drive
SOC Brief
Q: What is 'Situational Awareness'?
A: Knowing what is happening on your network in real-time.
Montance Resource Google Drive
SOC Brief
Q: What is the importance of 'Business Context'?
A: Understanding which assets are critical to the business to prioritize response.
Montance Resource Google Drive
SOC Brief
Q: What is the 'Feedback Loop'?
A: Using lessons learned from incidents to improve detection rules and prevention controls.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is the main goal of SOAR?
A: To improve the efficiency and effectiveness of security operations.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What are the three components of SOAR?
A: Orchestration, Automation, and Response.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is 'Orchestration'?
A: Coordinating tools and processes across different security technologies.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is 'Automation'?
A: Executing tasks without human intervention.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is 'Response'?
A: The actions taken to mitigate a threat.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is a 'Workflow'?
A: A sequence of processes or tasks.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is 'API Integration'?
A: Connecting different software tools programmatically.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is 'Case Management'?
A: Tracking incidents and investigations in a central system.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is 'Threat Intelligence Platform' (TIP)?
A: A tool for aggregating and analyzing threat data.
Montance Resource Google Drive
SOAR Presentation 2019
Q: What is 'ROI' in the context of SOAR?
A: Return on Investment, often measured in time saved.
Montance Resource Google Drive
HK Equifax So
Q: What region is focused on in this presentation?
A: Hong Kong / Asia Pacific.
Montance Resource Google Drive
HK Equifax So
Q: What is the 'Authorized Economic Operator' (AEO)?
A: A certification standard for supply chain security.
Montance Resource Google Drive
HK Equifax So
Q: What is the 'PDPO'?
A: Personal Data (Privacy) Ordinance - Hong Kong's data privacy law.
Montance Resource Google Drive
HK Equifax So
Q: What is the 'HKMA'?
A: Hong Kong Monetary Authority.
Montance Resource Google Drive
HK Equifax So
Q: What is 'C-RAF'?
A: Cyber Resilience Assessment Framework.
Montance Resource Google Drive
HK Equifax So
Q: What is 'iCAST'?
A: Intelligence-led Cyber Attack Simulation Testing.
Montance Resource Google Drive
HK Equifax So
Q: What is 'CREST'?
A: Council of Registered Ethical Security Testers.
Montance Resource Google Drive
HK Equifax So
Q: What is 'CBEST'?
A: A framework for intelligence-led penetration testing.
Montance Resource Google Drive
HK Equifax So
Q: What is 'TIBER-EU'?
A: Threat Intelligence-based Ethical Red Teaming.
Montance Resource Google Drive
HK Equifax So
Q: What is the 'Mitre ATT&CK' framework?
A: A knowledge base of adversary tactics and techniques.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is the 'Data Privacy Act of 2012'?
A: The primary data privacy law in the Philippines.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is 'NPC'?
A: National Privacy Commission (Philippines).
Montance Resource Google Drive
Manila HK Equifax So
Q: What is 'Circular 2016-03'?
A: A regulation on personal data breach management.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is the notification requirement for a breach?
A: Within 72 hours of discovery.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is 'Sensitive Personal Information'?
A: Data that discriminates, identifies health/sexual life, or involves government identifiers.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is 'Privileged Access Management' (PAM)?
A: Controlling and monitoring access for high-level users.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is 'Multi-Factor Authentication' (MFA)?
A: Requiring more than one method of verification for access.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is 'Network Segmentation'?
A: Dividing a network into smaller parts to limit lateral movement.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is 'Log Retention'?
A: Keeping audit logs for a specified period for investigation.
Montance Resource Google Drive
Manila HK Equifax So
Q: What is 'Incident Response Plan'?
A: A documented procedure for handling security incidents.
Montance Resource Google Drive
Denver Equifax So
Q: What was the root cause of the Equifax breach?
A: Failure to patch a known vulnerability in Apache Struts.
Montance Resource Google Drive
Denver Equifax So
Q: What specific vulnerability was exploited?
A: CVE-2017-5638.
Montance Resource Google Drive
Denver Equifax So
Q: What was the 'detection deficit' in the Equifax case?
A: Approximately 76 days.
Montance Resource Google Drive
Denver Equifax So
Q: What process failure contributed to the breach?
A: Lack of an effective asset inventory and patch management process.
Montance Resource Google Drive
Denver Equifax So
Q: What was the role of 'encryption' in the breach?
A: The attackers used encrypted channels to exfiltrate data, which was not inspected.
Montance Resource Google Drive
Denver Equifax So
Q: What is 'Command and Control' (C2)?
A: The method attackers use to communicate with compromised systems.
Montance Resource Google Drive
Denver Equifax So
Q: What is 'Web Shell'?
A: A malicious script uploaded to a web server to enable remote administration.
Montance Resource Google Drive
Denver Equifax So
Q: What is 'Lateral Movement'?
A: Moving from the initial compromise point to other systems in the network.
Montance Resource Google Drive
Denver Equifax So
Q: What is 'Data Exfiltration'?
A: The unauthorized transfer of data from a computer.
Montance Resource Google Drive
Denver Equifax So
Q: What is the lesson regarding 'Third Party Risk'?
A: Organizations are responsible for the security of the software components they use.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is the most common architectural failure in SOCs?
A: Lack of visibility.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Siloed' security?
A: Security tools and teams operating in isolation.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Alert Fatigue'?
A: Analysts becoming desensitized to frequent alarms.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Shadow IT'?
A: IT systems deployed without central approval or oversight.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Technical Debt'?
A: The implied cost of additional rework caused by choosing an easy solution now instead of a better approach.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Complexity' in security architecture?
A: The enemy of security; too many tools and configurations.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Scalability'?
A: The ability of a system to handle growing amounts of work.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Interoperability'?
A: The ability of different systems to work together.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Resilience'?
A: The capacity to recover quickly from difficulties.
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: What is 'Continuous Improvement'?
A: The ongoing effort to improve products, services, or processes.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is the 'Statement of Success' for a SOC?
A: When it intervenes in adversary efforts to impact the availability, confidentiality, and integrity of information assets.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What are the four classes of metrics?
A: Business, Technological, Operational, and Analytical.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is 'Mean Time to Detect' (MTTD)?
A: The average time it takes to identify a security incident.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is 'Mean Time to Respond' (MTTR)?
A: The average time it takes to contain and remediate a known security incident.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is 'Dwell Time'?
A: The time an attacker remains undetected in a network.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is 'False Positive Rate'?
A: The percentage of alerts that are not valid security incidents.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is 'Analyst Utilization'?
A: The percentage of time analysts spend on core tasks versus administrative overhead.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is 'Coverage'?
A: The percentage of assets or attack vectors monitored by the SOC.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is 'Maturity'?
A: The degree to which processes are defined, managed, and optimized.
Montance Resource Google Drive
CloudSecurity Alliance Metrics
Q: What is the 'Cyber Defense Matrix'?
A: A framework mapping security functions to asset types.
Montance Resource Google Drive
Darkreading PaloAltoNetworks SOAR
Q: What is the main focus of this document?
A: The benefits of Security Orchestration, Automation, and Response (SOAR).
Montance Resource Google Drive
Darkreading PaloAltoNetworks SOAR
Q: How does SOAR help with the 'Skills Gap'?
A: By automating Tier 1 tasks, allowing analysts to focus on higher-value investigations.
Montance Resource Google Drive
Darkreading PaloAltoNetworks SOAR
Q: What is a 'Playbook' in the context of SOAR?
A: A codified workflow of actions to be executed automatically or semi-automatically.
Montance Resource Google Drive
Darkreading PaloAltoNetworks SOAR
Q: What is the 'Cortex' brand?
A: Palo Alto Networks' suite of AI-driven security operations products, including XSOAR.
Montance Resource Google Drive
Darkreading PaloAltoNetworks SOAR
Q: What is the benefit of 'Case Management' in SOAR?
A: Centralizing communication and artifacts for an incident in one place.
Montance Resource Google Drive
SOC Stock Metrics
Q: Who is the author of the SOC Stock Metrics document?
A: David Mackey.
Montance Resource Google Drive
SOC Stock Metrics
Q: What are the four classes of metrics defined in the document?
A: Business Processes, Technological Processes, Operational Processes, and Analytical Processes.
Montance Resource Google Drive
SOC Stock Metrics
Q: What does the 'Number of devices per employee' metric track?
A: The ratio of SOC analysts to the number of monitored feeds/devices to prevent burnout.
Montance Resource Google Drive
SOC Stock Metrics
Q: What is the purpose of tracking 'Patched systems'?
A: To measure adherence to internal patch management policy.
Montance Resource Google Drive
SOC Stock Metrics
Q: What does the 'Top 10 events' metric show?
A: The most severe security events over time, used to identify attack trends.
Montance Resource Google Drive
SOC Stock Metrics
Q: What is the 'Golden Triangle' mentioned in the context of metrics?
A: People, Process, and Technology.
Montance Resource Google Drive
SOC Stock Metrics
Q: What is the 'Infected systems' metric?
A: Shows the number of systems infected by malcode and cleaned over time.
Montance Resource Google Drive
SOC Stock Metrics
Q: What is the 'Top 10 attacked ports' metric used for?
A: To show trends in port attacks by day.
Montance Resource Google Drive
SOC Stock Metrics
Q: What date was the document last updated?
A: Thursday, October 23, 2008.
Montance Resource Google Drive
SOAR Domaintools
Q: What is the primary benefit of SOAR according to the presentation?
A: It acts as a 'Force Multiplier' by automating repetitive tasks.
Montance Resource Google Drive
SOAR Domaintools
Q: Which SOAR platforms were mentioned?
A: Phantom, Demisto, and Swimlane.
Montance Resource Google Drive
SOAR Domaintools
Q: How does DomainTools integrate with SOAR?
A: By providing enriched domain and IP intelligence to automated playbooks.
Montance Resource Google Drive
SOAR Domaintools
Q: What specific use case was highlighted for automation?
A: Phishing triage and investigation.
Montance Resource Google Drive
SOAR Domaintools
Q: What is the 'Iris' platform mentioned?
A: DomainTools' investigation platform for threat intelligence.
Montance Resource Google Drive
SOAR Domaintools
Q: What is the value of 'Risk Score' in the integration?
A: It allows playbooks to make automated decisions based on the domain's reputation.
Montance Resource Google Drive
SOAR Domaintools
Q: How does the integration help with 'Pivoting'?
A: It allows analysts to automatically find connected infrastructure (e.g., other domains by the same registrant).
Montance Resource Google Drive
Darkreading Qualys AlertFatigue
Q: What is the primary problem addressed in this report?
A: Alert Fatigue in Security Operations Centers.
Montance Resource Google Drive
Darkreading Qualys AlertFatigue
Q: How does Qualys propose to reduce alert fatigue?
A: By providing better context and prioritization of vulnerabilities and threats.
Montance Resource Google Drive
Darkreading Qualys AlertFatigue
Q: What is 'AssetView'?
A: A Qualys service that provides a unified view of IT assets to help prioritize risks.
Montance Resource Google Drive
Darkreading Qualys AlertFatigue
Q: What is the relationship between 'Vulnerability' and 'Threat' in prioritization?
A: Prioritize vulnerabilities that have active threats/exploits against them.
Montance Resource Google Drive
Darkreading Qualys AlertFatigue
Q: What is 'ThreatPROTECT'?
A: A Qualys module that correlates vulnerability data with real-time threat intelligence.
Montance Resource Google Drive
Cybrary SOC Series 2 Tech 003
Q: What is the topic of the Cybrary SOC Series-2 Tech 003?
A: Technology Evaluations: Finding the Right SOC Solutions.
Montance Resource Google Drive
Cybrary SOC Series 2 Tech 003
Q: What is the first step in selecting SOC technology?
A: Defining the specific use cases and requirements for the organization.
Montance Resource Google Drive
Cybrary SOC Series 2 Tech 003
Q: Why is 'Integration' a critical evaluation criteria?
A: Tools must work together to provide visibility and workflow; isolated tools create silos.
Montance Resource Google Drive
Cybrary SOC Series 2 Tech 003
Q: What is the danger of 'Shelfware'?
A: Buying expensive tools that are never fully deployed or utilized due to complexity or lack of staff.
Montance Resource Google Drive
Cybrary SOC Series 2 Tech 003
Q: What role does 'POC' (Proof of Concept) play?
A: It allows the SOC to test the tool in their specific environment before purchase.
Montance Resource Google Drive
Darkreading Darktrace AI
Q: What is the 'Enterprise Immune System'?
A: Darktrace's core philosophy of using AI to learn 'self' and detect deviations, similar to a biological immune system.
Montance Resource Google Drive
Darkreading Darktrace AI
Q: What technology underpins Darktrace's solution?
A: Unsupervised Machine Learning.
Montance Resource Google Drive
Darkreading Darktrace AI
Q: How does Darktrace differ from traditional signature-based security?
A: It does not rely on prior knowledge of attacks (signatures) but learns normal behavior to detect anomalies.
Montance Resource Google Drive
Darkreading Darktrace AI
Q: What is 'Antigena'?
A: Darktrace's autonomous response solution that can take action to stop threats.
Montance Resource Google Drive
Darkreading Darktrace AI
Q: What is the benefit of '100% visibility' claimed?
A: Seeing all network traffic allows the AI to learn the full context of normal operations.
Montance Resource Google Drive
Darkreading ZScaler
Q: What is the 'Zero Trust Exchange'?
A: Zscaler's cloud-native platform that connects users to applications without placing them on the network.
Montance Resource Google Drive
Darkreading ZScaler
Q: How does Zscaler enable 'Secure Access Service Edge' (SASE)?
A: By converging networking and security services in the cloud.
Montance Resource Google Drive
Darkreading ZScaler
Q: What is the main advantage over traditional VPNs?
A: Reduced attack surface (apps are not visible to the internet) and better user experience.
Montance Resource Google Drive
Darkreading ZScaler
Q: What is 'Zscaler Internet Access' (ZIA)?
A: A secure web gateway that inspects traffic for malware and enforces policy.
Montance Resource Google Drive
Darkreading ZScaler
Q: What is 'Zscaler Private Access' (ZPA)?
A: Zero trust access to internal applications.
Montance Resource Google Drive
Darkreading ZScaler
Q: How does Zscaler handle SSL/TLS inspection?
A: It performs inspection at scale in the cloud without performance degradation.
Montance Resource Google Drive
Darkreading ZScaler
Q: What is the role of 'Policy Enforcement'?
A: To ensure consistent security rules regardless of user location.
Montance Resource Google Drive
Darkreading ZScaler
Q: How does it protect against data loss?
A: Through integrated Cloud DLP capabilities.
Montance Resource Google Drive
Darkreading ZScaler
Q: What is the 'Direct-to-Cloud' architecture?
A: Routing traffic directly to the cloud service rather than backhauling to a data center.
Montance Resource Google Drive
Darkreading ZScaler
Q: Who benefits most from this solution?
A: Distributed enterprises with a mobile workforce.
Montance Resource Google Drive
Darkreading Qualys
Q: What is the primary focus of the Qualys platform?
A: Cloud-based IT, security, and compliance solutions.
Montance Resource Google Drive
Darkreading Qualys
Q: What is the 'Cloud Agent'?
A: A lightweight agent installed on endpoints that provides real-time visibility.
Montance Resource Google Drive
Darkreading Qualys
Q: How does Qualys assist with 'Asset Management'?
A: By providing a Global AssetView of all IT assets across on-prem, cloud, and endpoints.
Montance Resource Google Drive
Darkreading Qualys
Q: What is 'Vulnerability Management, Detection and Response' (VMDR)?
A: An integrated workflow to discover, assess, prioritize, and patch vulnerabilities.
Montance Resource Google Drive
Darkreading Qualys
Q: How does Qualys handle 'Compliance'?
A: By mapping asset configurations to CIS benchmarks and other regulatory standards.
Montance Resource Google Drive
Darkreading Qualys
Q: What is the benefit of a 'Single Pane of Glass'?
A: Consolidated view of security posture across disparate environments.
Montance Resource Google Drive
Darkreading Qualys
Q: Does Qualys support container security?
A: Yes, through its Container Security module.
Montance Resource Google Drive
Darkreading Qualys
Q: What is 'Continuous Monitoring' in the Qualys context?
A: Real-time alerting on new vulnerabilities or configuration drift.
Montance Resource Google Drive
Darkreading Qualys
Q: What is the 'Patch Management' capability?
A: The ability to deploy patches directly from the cloud platform.
Montance Resource Google Drive
Darkreading Qualys
Q: Who is the target user?
A: Vulnerability managers, IT ops, and compliance officers.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: What is the core technology behind Deep Instinct?
A: Deep Learning neural networks applied to cybersecurity.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: How does Deep Learning differ from traditional Machine Learning in this context?
A: It uses raw data input without manual feature extraction, allowing for higher accuracy with less human intervention.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: What is the primary claim regarding 'Zero-Day' prevention?
A: Deep Instinct claims to prevent unknown and zero-day malware pre-execution.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: What is the 'Prediction' capability?
A: The ability to identify malicious files before they run based on static analysis.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: What platforms does the solution support?
A: Endpoints, servers, and mobile devices.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: How does the solution handle 'Fileless' attacks?
A: By monitoring memory and script execution behaviors.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: What is the false positive rate claimed?
A: Extremely low compared to traditional AV and ML solutions.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: Does it require frequent signature updates?
A: No, the model is trained offline and requires infrequent updates.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: What is the deployment model?
A: Agent-based.
Montance Resource Google Drive
Darkreading DeepInstinct AI
Q: Who is the target audience for this report?
A: CISOs and security architects looking for advanced prevention.
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What does CDFS likely stand for in this context?
A: Cyber Defense Force Singapore (or similar national/regional defense entity).
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What is the primary mission of the SOC described?
A: To monitor, detect, and respond to cyber threats against national critical infrastructure.
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What are the three core functional areas of this SOC?
A: Monitoring/Triage, Incident Response, and Threat Intelligence.
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What level of availability does the SOC maintain?
A: 24/7/365 operational capability.
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What is the 'Hub and Spoke' model mentioned?
A: A centralized SOC (Hub) coordinating with sector-specific or agency-specific SOCs (Spokes).
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What technology is central to their monitoring?
A: A SIEM (Security Information and Event Management) system.
Montance Resource Google Drive
CDFS SOC Capabilities
Q: How is 'Threat Intelligence' utilized?
A: To proactively hunt for threats and enrich alert data.
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What is the role of 'Tier 1' analysts?
A: Initial triage and validation of alerts.
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What is the role of 'Tier 2' analysts?
A: Deep dive investigation and incident response.
Montance Resource Google Drive
CDFS SOC Capabilities
Q: What metrics are prioritized?
A: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: What is the primary value proposition of Wiz?
A: Complete visibility into cloud risk without agents.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: What is 'Agentless Scanning'?
A: Connecting to the cloud environment via API/Snapshot to assess workloads without installing software on them.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: What is the 'Security Graph'?
A: A visualization of the relationships between assets, identities, and risks to identify toxic combinations.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: What is 'Toxic Combination'?
A: The intersection of a vulnerability, a misconfiguration, and high privileges/exposure that creates a critical risk.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: How does Wiz support 'Shift Left'?
A: By integrating with CI/CD pipelines to scan infrastructure as code (IaC) and container images.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: What cloud providers does Wiz support?
A: AWS, Azure, GCP, and others.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: What is the benefit for developers?
A: Frictionless security that doesn't impact runtime performance.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: How does it handle 'Secret Scanning'?
A: It detects hardcoded secrets in code and cloud resources.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: What is 'Cloud Security Posture Management' (CSPM) in Wiz?
A: Continuous assessment of cloud configurations against best practices.
Montance Resource Google Drive
Informa Wiz DevSecOps
Q: Who is the target audience?
A: Cloud security engineers, DevOps teams, and CISOs.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: What is the primary value of Threat Intelligence according to Mandiant?
A: To shift from reactive to proactive defense.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: What are the three types of Threat Intelligence?
A: Tactical, Operational, and Strategic.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: What is 'Attribution' in the context of Mandiant's intel?
A: Identifying the specific threat group (e.g., APT29, FIN7) behind an attack.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: How does Mandiant gather its intelligence?
A: Through frontline incident response engagements and global sensor networks.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: What is the 'Attack Lifecycle'?
A: The stages an attacker goes through, often mapped to the Cyber Kill Chain or MITRE ATT&CK.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: What is the recommendation regarding 'Indicators of Compromise' (IOCs)?
A: They are useful for detection but have a short shelf life; behavioral intel is more durable.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: Who should consume Strategic Intelligence?
A: Executive leadership and the board.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: What is 'Operational Intelligence' used for?
A: To guide ongoing investigations and prioritize alerts.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: What is the role of 'finished intelligence'?
A: To provide context, analysis, and actionable recommendations, not just raw data.
Montance Resource Google Drive
Darkreading Mandiant Threat Intel
Q: What sectors are most targeted according to recent trends?
A: Finance, Healthcare, and Government.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the top reported barrier to SOC success in the 2025 survey?
A: Budget constraints and lack of skilled staff.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the trend regarding 'Cloud Monitoring'?
A: A massive shift towards cloud-native monitoring tools as on-prem SIEMs struggle with volume.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the status of 'Automation' adoption?
A: It has moved from 'nice to have' to 'critical necessity' for handling alert volume.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the retention rate trend?
A: Retention remains a challenge due to high burnout and competitive salaries.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the role of 'AI/ML' in 2025 SOCs?
A: Widely adopted for anomaly detection and alert prioritization, but not replacing analysts.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the 'Hybrid SOC' model?
A: The dominant model, combining internal staff with MSSP/MDR support.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the focus on 'Resilience'?
A: A shift from 'prevention-first' to 'detection-and-recovery' mindset.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: How has 'Remote Work' impacted SOCs?
A: Permanent shift to distributed SOC teams and increased focus on endpoint/identity security.
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the 'Platform Approach'?
A: Consolidating point solutions into integrated platforms (e.g., XDR).
Montance Resource Google Drive
Key Findings 2025 SOC Survey
Q: What is the key metric for 2025?
A: Mean Time to Contain (MTTC) is becoming more important than MTTD.
Montance Resource Google Drive
Threat Hunting
Q: Overview
A: Presentation details for Threat Hunting
Montance Resource Google Drive
Top8StepsForMobile AppAssessmentFocus
Q: Overview
A: Presentation details for Top8StepsForMobile AppAssessmentFocus
Montance Resource Google Drive
The Definition of SOC-cess?
Q: Overview
A: Presentation details for The Definition of SOC-cess?
Montance Resource Google Drive
2019 SOC Survey
Q: Overview
A: Presentation details for 2019 SOC Survey
Montance Resource Google Drive
SOC Survey Preview
Q: Overview
A: Presentation details for SOC Survey Preview
Montance Resource Google Drive
Educause V0toVHard FULL
Q: Overview
A: Presentation details for Educause V0toVHard FULL
Montance Resource Google Drive
Educause V0toVHard Short
Q: Overview
A: Presentation details for Educause V0toVHard Short
Montance Resource Google Drive
Vampirism and the Donut Economy
Q: Overview
A: Presentation details for Vampirism and the Donut Economy
Montance Resource Google Drive
Mobile Attack Surface
Q: Overview
A: Presentation details for Mobile Attack Surface
Montance Resource Google Drive
WWHF Hunting by Numbers
Q: Overview
A: Presentation details for WWHF Hunting by Numbers
Montance Resource Google Drive
Giving Effective Presentations
Q: Overview
A: Presentation details for Giving Effective Presentations
Montance Resource Google Drive
Use Case Development: Excerpt
Q: Overview
A: Presentation details for Use Case Development: Excerpt
Montance Resource Google Drive
STH Metrics SOC User Awareness
Q: Overview
A: Presentation details for STH Metrics SOC User Awareness
Montance Resource Google Drive
2020 SOC Survey Results
Q: Overview
A: Presentation details for 2020 SOC Survey Results
Montance Resource Google Drive
RSA Technology Taxonomy
Q: Overview
A: Presentation details for RSA Technology Taxonomy
Montance Resource Google Drive
SOC Architecture Maturity Failures
Q: Overview
A: Presentation details for SOC Architecture Maturity Failures
Montance Resource Google Drive
Cybrary SOC Series 003
Q: Overview
A: Presentation details for Cybrary SOC Series 003
Montance Resource Google Drive
Cybrary SOC Series 004
Q: Overview
A: Presentation details for Cybrary SOC Series 004
Montance Resource Google Drive
Mobile Attack Surface AATCC
Q: Overview
A: Presentation details for Mobile Attack Surface AATCC
Montance Resource Google Drive
Cybrary SOC Series-2 Tech 001
Q: Overview
A: Presentation details for Cybrary SOC Series-2 Tech 001
Montance Resource Google Drive
Cybrary SOC Series-2 Tech 002
Q: Overview
A: Presentation details for Cybrary SOC Series-2 Tech 002
Montance Resource Google Drive
Cyber Solutions Fest 2021
Q: Overview
A: Presentation details for Cyber Solutions Fest 2021
Montance Resource Google Drive
FORCEDENTRY
Q: Overview
A: Presentation details for FORCEDENTRY
Montance Resource Google Drive
DarkReading Montance TITH
Q: Overview
A: Presentation details for DarkReading Montance TITH
Montance Resource Google Drive
ODSC Pandas
Q: Overview
A: Presentation details for ODSC Pandas
Montance Resource Google Drive
FORCEDENTRY - Paris
Q: Overview
A: Presentation details for FORCEDENTRY - Paris
Montance Resource Google Drive
Picus SANS Keynote 2021
Q: Overview
A: Presentation details for Picus SANS Keynote 2021
Montance Resource Google Drive
SOC Survey Intro 1
Q: Overview
A: Presentation details for SOC Survey Intro 1
Montance Resource Google Drive
PSW #760
Q: Overview
A: Presentation details for PSW #760
Montance Resource Google Drive
SOC Survey Data 2
Q: Overview
A: Presentation details for SOC Survey Data 2
Montance Resource Google Drive
2023 SOC/SOAR Solutions Forum
Q: Overview
A: Presentation details for 2023 SOC/SOAR Solutions Forum
Montance Resource Google Drive
TrendMicro
Q: Overview
A: Presentation details for TrendMicro
Montance Resource Google Drive
SOC Panel: Finding, Keeping, and Caring for the Best People
Q: Overview
A: Presentation details for SOC Panel
Montance Resource Google Drive
SOC Survey - The Hack Summit
Q: Overview
A: Presentation details for SOC Survey - The Hack Summit
Montance Resource Google Drive
Cyber Solutions Fest 2023
Q: Overview
A: Presentation details for Cyber Solutions Fest 2023
Montance Resource Google Drive
BLASTPASS SANS HackFest
Q: Overview
A: Presentation details for BLASTPASS SANS HackFest
Montance Resource Google Drive
Arab Intl Cybersecurity Conference
Q: Overview
A: Presentation details for Arab Intl Cybersecurity Conference
Montance Resource Google Drive
2024 SOC Survey
Q: Overview
A: Presentation details for 2024 SOC Survey
Montance Resource Google Drive
Kuwait Fundamentals and Best Practices for the SOC
Q: Overview
A: Presentation details for Kuwait Fundamentals and Best Practices for the SOC
Montance Resource Google Drive
Madrid SANS - 2023 SOC Survey
Q: Overview
A: Presentation details for Madrid SANS - 2023 SOC Survey
Montance Resource Google Drive
2023 SANS SOC Survey Review
Q: Overview
A: Presentation details for 2023 SANS SOC Survey Review
Montance Resource Google Drive
Fall Cyber Solutions Fest 2024
Q: Overview
A: Presentation details for Fall Cyber Solutions Fest 2024
Montance Resource Google Drive
Anomaly Detection within ML on Logs
Q: Overview
A: Presentation details for Anomaly Detection within Machine Learning on Logs
Montance Resource Google Drive
SANS 2025 SOC Survey
Q: Overview
A: Presentation details for SANS 2025 SOC Survey Webcast & Forum
Montance Resource Google Drive
The Evolution of Security Operations
Q: Overview
A: Presentation details for The Evolution of Security Operations
Montance Resource Google Drive
Cybersecurity Today TV Show - Ep 59
Q: Overview
A: Presentation details for Cybersecurity Today TV Show - Ep 59
Montance Resource Google Drive
ISACA Future Tech 2025
Q: Overview
A: Presentation details for ISACA Future Tech 2025
Montance Resource Google Drive