Kuwait Fundamentals and Best Practices for the SOC (Document)

--- Page 1 --- www.amanteckw.com FUNDAMENTALS AND BEST PRACTICES FOR THE SOC Q&ACybersecurityWebinar The Webinar is starting soon Host WaleedBouruki Speaker ChristopherCrowley --- Page 2 --- Page 2 AMANTec, emerging from a legacy, offers tailored cybersecurity and IT solutions to safeguard businesses' digital assets with acute awareness of their critical importance. About Us Previously ICON Kuwait of custom cybersecurity solutions Lead Provider in delivering Cybersecurity Awareness Trainings. Industry Veterans --- Page 3 --- Christopher Crowley Montance® LLC Founder of Montance® LLC, a solo consulting firm, is known for his roles as an author and cybersecurity instructor with over 15 years of experience. Specializing in Security Operation Centers (SOC), he offers valuable advice to clients to enhance their security measures. Consultant, Author, Instructor Page 3 --- Page 4 --- Cybersecurity Operations: Fundamentals and Best Practice There’s a lot of additional information available online https://montance.com/pres SOC-Class.com || Montance® LLC 4Copyright 2024 Montance® LLC - All Rights Reserved. All Wrongs Reversed? --- Page 5 --- Christopher Crowley – Montance® LLC - Background: root on (Ultrix/VMS) employer systems at 15 years old (80s #CYBER) - Sectors: Defense, Education, Energy, Government, Software Development, Financial, Telecom… - Consultant, author of SOC- Class.com: Security Operations, Design, Build, Operate. Teaches SANS: SEC575, SEC511, SEC504 Montance® LLC 5 --- Page 6 --- Threats Why we need Cybersecurity Operations SOC-Class.com || Montance® LLC 6Copyright 2024 Montance® LLC - All Rights Reserved. All Wrongs Reversed? --- Page 7 --- Threat Taxonomy ($B,$M,$T) Montance® LLC 7 - This adapted figure (ES.1 Threat Taxonomy) from US DOD Defense Science Board report Resilient Military Systems… - groups threats into ten, million, and billion dollar level resource capability clubs where: - $T: reuse vulnerabilities, - $M: discover vulnerabilities, - $B: create vulnerabilities. https://nsarchive2.gwu.edu/NSAEBB/NSAEBB424/docs/Cyber-081.pdf $ Billions $ Millions $ Tens --- Page 8 --- Cybersecurity Operations Defined SOC-Class.com || Montance® LLC 8Copyright 2024 Montance® LLC - All Rights Reserved. All Wrongs Reversed? --- Page 9 --- Functional Components of SOC Security Operations: Protecting the confidentiality, integrity, and availability of an organization’s information systems through proactive designand configuration, continuous monitoringof system state, detection of unintended actions or undesirable state, and minimizing damage from unwanted affects. --- Page 10 --- SOC-Class Reference Architecture SOC-Class.com || Montance® LLC 10Copyright 2024 Montance® LLC - All Rights Reserved. All Wrongs Reversed? --- Page 11 --- Functional Areas of a SOC Steering Committee Command Center Monitoring Threat Intelligence Incident Handling Forensics Self-Assessment --- Page 12 --- Functional Components of SOC - To discuss a SOC, I discuss the functional capabilities a SOC is expected to perform - I address in the SOC-Class - Software and hardware to make a SOC - SOC structural arrangements - SOC interactions to the constituents - Processes for repeatable, effective operations - Orchestration and Automation guidance --- Page 13 --- Components by Another Name - You might call these functions different things - Functions may be combined: CC+MON, IR+FOR, TI+SA (or other variations) - Likely have a pool of staff to accomplish these various tasks without separation by function - Might be with arranged between staff and outsourced partners (outsourcing section later) - The SOC needs to do all these things --- Page 14 --- Command Center - The Command Center directs action and manages communication of all security operations related activity - Single point of entry for security related requests (telephone number for police/fire/health emergencies) - Authority to direct response and notify constituents - Verification, escalation, triage, deconfliction of incidents - Objective: Maintain situational awareness of systems and threat environment, manage threats, proactively protect systems, engage appropriate parties, meet reporting SLAs --- Page 15 --- SOC Operations - SOC Operations – Probably Command Center or Monitoring sub-function - There is quite a bit of care and feeding required for whatever technology we select - Where does this belong within the SOC? - Infrastructure as part of Command Center - Maybe be in MON or “matrixed” in small SOC - Usually in CC or MON, unlikely in other functions --- Page 16 --- Monitoring - Fundamental and critical: monitor for issues - Watching the actions and communication of the information systems for unwanted activity, common failure is bad inventory of systems and owners (defensive topography) - Dedicated hardware, software, and staff - Gigantic amounts of constantly changing data - Objective: fast, accurate detection of issues --- Page 17 --- Threat Intelligence - Insecure systems won’t be compromised/impacted without a threat leveraging the vulnerability - Study threats to our environment (predicted and experienced) to better prepare, detect, and respond - We have the home field advantage, let’s use it! - Produce and/or consume threat intelligence - Keep organization informed of threat landscape - Objective: tactical and strategic advantage over adversaries --- Page 18 --- Incident Handling - Incident Response is engaged once a problem is detected, usually by MON or external notification - Strives to minimize the damage from the incident - Analysis to determine extent of the incident - Assist to return systems to normal state - Leverages lessons learned from incidents to enhance security posture and defensibility of the organization - Objective: minimize impact of problems --- Page 19 --- Incident Handling - Emblematic description: Three characters of incident response - Janitorial Services: low cost, routine - Fire Fighters: intervention, minimize loss - Apex Predator: high performance - https://www.mgt517.com/ir3 --- Page 20 --- Forensics - Often supporting Incident Response, authoritative capability to detail the methodology and extent of the incident - Also useful for self-assessment within procurement process - Can separate further into these forensics specialties - Host - Network - Reverse Engineering - eDiscovery - Objective: detailed data and event analysis for incident verification and impact assessment --- Page 21 --- Forensics – Host - Host Forensics studies data on individual systems – including cloud, mobile devices and memory forensics - Indicators of Compromise, used to scope intrusion - Application data - Operating system artifacts - Logs - Objective: collection of artifacts and detailed analysis of events on systems of interest --- Page 22 --- Forensics – Network - Network Forensics studies network artifacts - Switch/Router/Firewall Logs - Proxy Logs - Mail Logs - … Logs - Full Packet Capture (PCAP) - Objective: detailed analysis of events on network to understand what was compromised --- Page 23 --- Forensics – Reverse Engineering - RE is very difficult but incredibly useful - Studies hardware or software - Determines the capability of the item studied - Frequently malware (software) analysis - Also, could be firmware, hardware, etc. - Objective: analysis to determine the capability of hardware or software in use in the organization to determine its appropriateness --- Page 24 --- Forensics – eDiscovery - eDiscovery is a necessary capability in every organization - If it already exists don’t fight to bring it into the SOC - If you are building a SOC and don’t have it, incorporate into design - Often interfaces with Legal team to define collection objectives - Leverages existing infrastructure to efficiently support collection - Manage retention of records (email, texts, documents, etc.) - Fulfill obligation to support electronic discovery - Example: US Government Freedom of Information Act (FOIA) requests must be filled upon request or justify not supplying the data - Objective: Collect specified information assets in a reproducible (hence defendable), cost effective, and thorough fashion --- Page 25 --- Self-Assessment - Configuration Monitoring - Vulnerability Management - Pen Testing - Exercises - Objective: ongoing assessment of attack surface of information systems and organization capability to resist compromise and recover gracefully when incidents occur --- Page 26 --- Configuration Monitoring - CM is the practice of approving change and detecting variation from approved baselines and configurations - Change Control and approval - File Integrity Monitoring / Application Whitelisting - Baseline and standard approved configurations - Deviation authorization and tracking - Continuous Monitoring for change identification - Objective: Develop system and application baselines and configurations, support monitoring changes from specified baseline settings to return to specification --- Page 27 --- Vulnerability Management - Vulnerability Management is testing systems for issues, such as missing patches or misconfiguration and directing remediation and getting identified issues resolved - Typically performed by a vulnerability scanner - Software with inventory of known patches and flaws, and methods for checking if they’re missing - Objective: identify attack surface of systems: such as vulnerabilities of known flaws or weak configurations, minimizing attack opportunities and effectiveness --- Page 28 --- Penetration Testing - Pen Testing goes beyond vulnerability scans to model/demonstrate how an adversary would compromise a system and what is at risk - Time intensive, substantial expertise required - Objective: determine the risk of an information system by demonstrating impact of a compromise and model adversary attack methods against a system --- Page 29 --- Penetration Testing Drives Change - When I say, you have to patch MS20-013, organizations usually don’t care and make all sorts of excuses or operational reasons why not - When I say in the debrief of the pen-test: I broke in to your accounts payable system and sent myself a check for $100,000 - patches happen quickly - True also for your SOC analysts, SOC pen testers are internal motivation --- Page 30 --- Exercises - Exercises model plausible scenarios and challenge the staff identify it, then follow the procedures appropriate to that scenario. Exercises reinforce authorized / good practices - Very valuable, often neglected - The culture of “too busy” frequently prevents exercises - Improvement presumed to occur somehow “in process” - Objective: assess staff readiness, capability to follow defined procedures and improvise in the face of unanticipated issues --- Page 31 --- Maturity Assessment Methods SOC-CMM MITRE ATT&CK SOC-Class.com || Montance® LLC 31Copyright 2024 Montance® LLC - All Rights Reserved. All Wrongs Reversed? --- Page 32 --- SOC-CMM Based Maturity - SOC CMM for assessment of maturity - Not the same as my SOC- class, but strong correlation --- Page 33 --- ATT&CK Anatomy --- Page 34 --- ATT&CK Terminology: IOC vs TTPs - Indicator of Compromise (IOC): specific trait of malicious activity - ATT&CK considers its Behavioral Analytics Development an upgrade from IoCs that moves away from specific details of software and moves toward techniques an adversary must use or implement to accomplish a tactic - Tactics, Techniques, Procedures (TTPs): industry name for all encompassing descriptors of adversary capability and behavior. ATT&CK is a framework to enumerate and communicate TTPs, with the added capability to articulate what can be done to detect and interfere (degrade, disrupt, deceive,…) with the TTPs in OSes --- Page 35 --- MITRE ATT&CK Intention - Adversary Emulation - Red Teaming - Behavioral Analytics Development - Defensive Gap Analysis - SOC Maturity Assessment - Cyber Threat Intelligence Enrichment - (These are expressed in the white paper) 35 --- Page 36 --- MITRE ATT&CK: Defensive Gap Analysis - MITRE suggests ATT&CK framework use is to identify the coverage aspect of the SOC’s defensive posture through “Defensive Gap Analysis” - Blue – High Confidence - Yellow – Med Confidence - Orange – Low & no plan --- Page 37 --- MITRE ATT&CK Maturity - Lessons Learned Applying ATT&CK-Based SOC Assessments - Assumes a “third party” external assessment, but can be self- assessed. Takes 1-2 months - Inputs: survey, documentation, & interviews. Document review only - Artifacts: detection heatmap, prioritization plan of TTPs for detection improvement based on threat intelligence and MITRE analyst direction 37 --- Page 38 --- Operations SOC-Class.com || Montance® LLC 38Copyright 2024 Montance® LLC - All Rights Reserved. All Wrongs Reversed? --- Page 39 --- Cross-Functional Flowchart Next Progression Next Section Steering Committee Command Center Monitoring Threat Intelligence Incident Response Forensics Self Assessment Receive Incident Reports Review Metrics Reports Review Pen Test Reports Review Vulnerability Status Review Configuration Monitoring Information Review Exercise Results Adequate Performance? Acceptable Risk? Review Updated Threat Information Updated Business Information Appropriate Changes? Update Policy Modify Internal Process Change Required? Modify Internal Process Accept Incoming Request Deconflict Validate Report Deconflict Update Existing Incident Direct Response Actions Create Incident Notify Constituents Modify Internal Process Incident Declaration Collect Data Validate Data Parse Data Correlate Data Investigate Alert Data Mining aka Hunting Data Sharing Modify Internal Process Collect Open Source Data Track Adversaries Mine Internal Data Disseminate Intelligence Internally Attribute Event to Adversary Modify Internal Process Investigate Contain Eradicate Coordinate Report Modify Internal Process Network Host Reverse Engineering Modify Internal Process Vulnerability Assessment Configuration Management Penetration Testing Exercises E-Discovery Back to Flowchart --- Page 40 --- Steering Committee Command Center Monitoring Threat Intelligence Incident Response Forensics Self Assessment Receive Incident Reports Review Metrics Reports Review Pen Test Reports Review Vulnerability Status Review Configuration Monitoring Information Review Exercise Results Adequate Performance? Acceptable Risk? Review Updated Threat Information Updated Business Information Appropriate Changes? Update Policy Modify Internal Process Change Required? Cross-Functional Flowchart Next Progression Next SectionBack to Flowchart --- Page 41 --- Steering Committee Command Center Monitoring Threat Intelligence Incident Response Forensics Self Assessment Modify Internal Process Cross-Functional Flowchart Accept Incoming Request Deconflict Validate Report Deconflict Update Existing Incident Direct Response Actions Create Incident Notify Constituents Next Progression Next SectionBack to Flowchart --- Page 42 --- Steering Committee Command Center Monitoring Threat Intelligence Incident Response Forensics Self Assessment Modify Internal Process Cross-Functional Flowchart Incident Declaration Correlate Data Investigate Alert Data Mining Data Sharing Collect Data Validate Data Parse Data Next Progression Next SectionBack to Flowchart --- Page 43 --- Steering Committee Command Center Monitoring Threat Intelligence Incident Response Forensics Self Assessment Modify Internal Process Cross-Functional Flowchart Collect Open Source Data Track Adversaries Mine Internal Data Disseminate Intelligence Internally Attribute Event to Adversary Next Progression Next SectionBack to Flowchart --- Page 44 --- Steering Committee Command Center Monitoring Threat Intelligence Incident Response Forensics Self Assessment Modify Internal Process Cross-Functional Flowchart Investigate Contain Eradicate Coordinate Report Next Progression Next SectionBack to Flowchart --- Page 45 --- Steering Committee Command Center Monitoring Threat Intelligence Incident Response Forensics Self Assessment Modify Internal Process Cross-Functional Flowchart Network Host ReportAnalyze evidenceAssure Evidence IntegrityAcquire Evidence Reverse Engineering E-Discovery ReportAnalyze evidenceAssure evidence integrityAcquire evidence Retain Data Process and deliver data Acquire evidence Scope of request ReportAnalyze evidenceAssure evidence integrityAcquire evidence Next Progression Next SectionBack to Flowchart --- Page 46 --- Steering Committee Command Center Monitoring Threat Intelligence Incident Response Forensics Self Assessment Modify Internal Process Cross-Functional Flowchart Vulnerability Assessment Penetration Testing Discover intelligenc e on org Model Adversary activity Coordinate with operations and control center Assess Systems Exercise Configuration Management Manage exceptions Track Remidiatio n Correlate new vul. to assets Scan assets for known vul. Assess and approve user exceptions Create baselines and standards Assess changes of systems Change approval process Improve user performan ce Assess user defensive prsture Assess DR & BCP Conduct exercises Next Progression Next SectionBack to Flowchart --- Page 47 --- Threat Hunting SOC-Class.com || Montance® LLC 47Copyright 2022 Montance® LLC - All Rights Reserved. --- Page 48 --- Succinct Threat Hunting Definition Investigation of data presuming alerting failed Montance® LLC 48 --- Page 49 --- Hunting Compared to: Detection Engineering / Cyber Use Cases --- Page 50 --- Good Hunting Drives Good Engineering - Hunting is “clumsy but swift” yet we want swiftness to inform where the engineering effort is actually worth deploying a lot of effort - One hunting outcome: ideas for use cases - Hunts show gaps and oversights, posture improvement recommendations and detection revisions are another outcome of hunts - Leverage vendor partners and community efforts as the basis of your engineered detections, then customize as appropriate for your environment, hunting helps develop these customizations Montance® LLC 50 --- Page 51 --- Use Case Definition A Cyber Security Use Case describes a relevant scenario of compromise and potential method(s) of detecting this offensive activity. @CCrowMontance Business relevance Characteristics Artifacts Detection Enrichment Implementation Assessment Review --- Page 52 --- Use Cases Engineering - SOC Use Cases: an engineering effort - Identify scenario of interest and business relevance - Characteristics of scenario (decompose it) - Related artifacts - Detection opportunities in data - Enrichment opportunities in data (external threat info, internal correlation) - Engineering / implementation - Monitoring / assessment - Use case revision / review / expiration Expanded use-case dev: mgt517.com/use-cases --- Page 53 --- Failures What to Avoid SOC-Class.com || Montance® LLC 53Copyright 2020 Montance® LLC - All Rights Reserved. All Wrongs Reversed? --- Page 54 --- No Vision for Architecture - You might disagree with my reference architecture. If you do, I’d love to discuss what you think is missing or superfluous - If you’ve put that much thought into it already, congratulations you haven’t fallen into the trap of this failure - The failure: no clear vision of architecture Montance® LLC 54 --- Page 55 --- Steering Committee - Almost no organization starts the SOC project by identifying the Steering Committee structure and members. Why would you? It’s all about monitors, shift work and Tier 1-3 Analysts, SIEMs, Threat Intelligence Feeds, … - The failure: steering committee doesn’t exist or is inept so SOC direction (hence the term Steering) isn’t defined and there’s tremendous waste of effort Montance® LLC 55 --- Page 56 --- Defensive Topography - IT growth is persistent. SOCs rarely integrate into IT system development and deployment processes. SOCs rarely integrate into procurement and contracting - The failure: defensive topography is presumed to be someone else’s responsibility to give to the SOC. No. The SOC is responsible for cataloging “well managed systems” and “everything else”; knowing what assets are authorized Montance® LLC 56 --- Page 57 --- Foresight, Consistency, Self-Discipline - Maturity is the term that is often discussed, but rarely defined - There were two clear (and freely available) methods of assessing maturity. If your SOC has already adopted one (anything) and self-assesses annually you haven’t made this mistake - The failure: SOC constituents change the maturity measurements frequently because there was no clear agreement of maturity objectives initially Montance® LLC 57 --- Page 58 --- Christopher Crowley - This slide deck and others available: https://montance.com/pres - Upcoming in 2024: - 2024 SOC-Survey https://soc-survey.com - Blackhat Riyadh - Hopefully return to Kuwait Montance® LLC 58 --- Page 59 --- www.amanteckw.com Q&A Thank you for your attention and participation. We welcome any questions you may have.