Overview

MGT551 starts with the critical elements necessary to build your Security Operations Center: understanding your enemies, planning your requirements, making a physical space, building your team, and planning important data collection. Throughout this course section, students will learn how to build a strong foundation upon which an SOC can operate, including focusing defense on the most important users and data, and tailoring defense plans to high-risk threat groups. Through optimization of workflow, information organization, and data collection, you will learn how to ensure that your security operations will hit the ground running as efficiently as possible. Exercises show how to implement these concepts through threat group and asset profiling, playbook workflow creation and implementation, and the generation and organization of use cases for the SOC.

Exercises

• Defining Your Assets and Adversaries
• Developing and Implementing SOC Playbooks
• Structuring, Documenting, and Organizing Use Cases

Topics

Introduction

• What we are up against/industry surveys
• The average SOC
• What top-performing SOCs have in common
• SOC trends
• Class goals

SOC Functions

• High-level SOC diagram
• SOC functions
• Core activities
• Auxiliary functions

SOC Planning

• Do you need a dedicated internal SOC?
• What is and what is not a SOC?
• Mission and purpose
• Requirements
• Standards and frameworks
• Policies
• Roles
• Staffing levels
• Constituency
• Steering committee
• Services/Capabilities
• Charter

Building the SOC

• Physical space
• Analyst/SOC IT considerations
• Protecting SOC data

SOC Tools and Technology

• Foundational network and endpoint collection and detection technologies
• "Next-gen" must-have capabilities
• Advanced detection technologies
• Analyst core toolset
• Playbooks and SOAR

Team Creation, Hiring, and Training

• Organizational charts
• Choosing a tiered vs. tierless SOC
• Building a dream team
• Interviewing tips and techniques
• Interviewing mistakes and avoiding bias
• Training plans

Mental Models for SOC Operations

• Ops Tempo and the OODA Loop
• Threat modeling
• MITRE ATT&CK/Kill Chain
• Threat Intel - F3EAD
• Pyramid of pain and analytic types
• The SOC as an "infinite game"

Data Collection

• The SOC data collection system
• Open-source NSM and host-data tools
• Collection issues

• Tactical log collection
• Audit policy flexibility
• Most important data sources
• How to collect data
• Parsing, filtering, enrichment, and storage

Use Case Development and Storage

• Analytic rule types
• Analytic rule life cycle
• Use case organization and storage

Overview

The second day of MGT551 focuses on understanding and improving everyday SOC activities such as detection design, investigation and triage, threat hunting, active defense, and incident response. We'll look at all the exciting new tools in the blue team space that can improve your team in these areas. Additionally, we'll tackle common concerns such as employee retention and the prevention of burnout, as well as improvement measures such as analytic testing and false positive reduction, measurement and execution of SOC growth initiatives, adversary emulation, and purple team testing. Exercises include attack technique prioritization with MITRE ATT&CK Navigator, a guided exercise on how to define, derive, and track the most important metrics for your SOC, and a walk-through with examples of how to plan and track a purple team assessment to ensure your SOC is delivering on its goal of improving cyber defense and resiliency.

Exercises

• Prioritizing and Visualizing Attack Techniques and Security Controls
• Creating, Classifying, and Communicating Your Metrics
• Purple Team Assessment Planning, Execution, and Tracking

Topics

Detection and Analytic Design

• SOC threat detection systems
• Analytic outcomes and tuning
• Writing high-fidelity rules
• Dealing with high-volume alerts
• Risk-based scoring and alert aggregation

Analytic and Analysis Frameworks and Tools

• Blue team knowledge standardization and upcoming tools
• ATT&CK Navigator
• Yara
• Sigma
• Jupyter notebooks
• Detection testing labs

Threat Hunting

• What is threat hunting and why is it needed?
• Scheduling
• Data quality
• Hunting process and techniques
• Hunting maturity model
• Showing the value of threat hunting

Active Defense

• What is active defense/deception?
• Active defense techniques and goals
• Tooling

Alert Triage and Investigation

• Tiered vs. tierless SOC triage process
• Where to triage alerts
• Software for triage and desired features
• Prioritization of alerts
• Investigation issues and tactics
• Structured analysis - brainstorming, ACH, externalization, decomposition

Incident Response (IR) Planning

• IR policy, plans, and procedures
• Staffing for IR
• Communication guidelines and methods
• IR go bags
• Live IR - Guarding your credentials
• Malware analysis sandboxes and analysis methods
• Containment procedures
• Eradication
• Watch and learn
• Recovery
• Post-incident activity
• Lessons learned

Staff Retention and Mitigation of Burnout

• Cultivating intrinsic motivation in your team
• SOC human capital model

• Growth, skills, empowerment, and creativity
• Automation, Ops efficiency, management/metrics

• Burnout mitigation tactics for new and experienced analysts
• Optimizing tasks for analyst growth
• Performance management

Metrics, Goals, and Effective Execution

• Daily Ops vs. initiatives
• Metrics vs. KPIs. vs. OKRs
• Selecting metrics
• Metrics sampling rates

• Selecting KPIs
• Organizing operational measures

• Creating OKRs
• Successful execution

• Metrics types
• Goal setting
• Acting on the right metrics
• Scoreboards
• Keeping a cadence of accountability

Analytic Testing and Adversary Emulation

• Analytic testing
• Analytic testing tools
• Automated assessments
• Penetration resting, red teaming, and adversary emulation
• Purple team vs. red team execution and benefits
• Purple teaming
• Benefits
• Methodology and execution
• Reporting and tracking tools