Please enable JavaScript.
Coggle requires JavaScript to display documents.
Cyberops MODULE 1-2 JARGON - Coggle Diagram
Cyberops MODULE 1-2 JARGON
(ISC)2 is an international nonprofit organization that offers the CISSP certification.
ISC2 = Nonprofit +CISSP cert
SIEM systems are used for collecting and filtering data, detecting and classifying threats, and analyzing and investigating threats. SOAR technology does the same as SIEMs but it also includes automation. SOAR integrates threat intelligence and automates incident investigation. SOAR also responds to events using response workflows based on previously developed playbooks.
SOAR automates incident investigation and responds to workflows based on playbooks.
SIEM =collecting + filtering data, detecting + classifying threats, analyzing + investigating threats
SOAR = SIEM + Automation
SOAR = Threat intelligence + automates incident investigation, respond events response workflows with developed playbooks
In a SOC, Tier 3 SMEs have expert-level skills in network, endpoint, threat intelligence, and malware reverse engineering (RE). They are deeply involved in hunting for potential security threats and implementing threat detection tools.
SME = Subject Matter Expert.
TIER 3 SME = network + endpoint + threat intelligence + malware reverse engineer + hunting for potential security threats + threat detection tools + advanced threat detection + Incident Response + Malware Analysis + Security Tool Management + Vulnerability Management + Security Analytics + Security Documentation + Collaboration + Knowledge Sharing
Technologies in a SOC should include the following:
Event collection + correlation + analysis
Security monitoring + control
Log management
Vulnerability assessment + tracking
Threat intelligence
Proxy server, VPN, and IPS are security devices deployed in the network infrastructure.
TERMS
SOC
Security Operations Center.
Vulnerability Management
Alerting and Reporting
Security Tools and Technologies
Continuous Monitoring
Incident
Detection +
Triage
+ Investigation
Threat Intelligence
Security Policies and Procedures
Training and Awareness
Incident Response
The major categories of elements in a SOC
Technology
Security Orchestration, Automation, and Response (SOAR)
SOAR
Security Orchestration, Automation, and Response.
Alert Triage
Integration
Analytics and Reporting
Threat Intelligence Integration
Case Management
Incident Response
Automation
Security Orchestration
Security Analytics and Visualization
Forensic and Incident Response Tools
User and Entity Behavior Analytics (UEBA)
Threat Intelligence
Endpoint Detection and Response (EDR)
Intrusion Detection and Prevention Systems (IDS/IPS)
Security Information and Event Management (SIEM)
Firewalls
Vulnerability Management
Access Control and Identity Management
Encryption and Data Loss Prevention (DLP)
People
Processes
SIEM
A security information and event management system (SIEM) combines data from multiple sources to help SOC personnel collect and filter data, detect and classify threats, analyze and investigate threats, and manage resources to implement preventive measures.