Hi everyone, I am Venicia, and today I'll be sharing my ultimate guide to Cyber Security
Operations.
0:07 Welcome to my channel where we learn all about
cyber security and how you can succeed as a woman in cyber security.
0:13 If you are looking for the ultimate guide
to cyber security operations, then this is the perfect video for you. We'll go through
what I've learnt as an industry expert and see how it can apply to you or your career journey.
0:25 Now, as always, before we get started, here
is your cyber security tip for the week. If you are connecting to a public Wi-Fi, then
don't access any sensitive applications, data systems, corporate resources, or anything
of the sorts, even though it's free, just don't do it.
0:40 Alright, so this video will be part one of
a video series that I'll be doing around breaking down the different areas of focus within cyber security.
We have discussed that cyber security is you know, really the umbrella term. And there's
so many different fields, industry job types that you can explore within cyber security.
And so you really got to streamline that and narrow it down. And this is the first part
in longer part video series. And then I'll be doing discussing these different focus
areas.
1:11 Now, the there's a lot of good information
that explains these different domains and really defines the domains and breaks them
down, you can go and have a look at ISC2 how they have broken down the eight domains of
CISSP. SANS has a great breakdown. And then NIST, of course, is a great fundamental resource
for you to understand the cyber workforce framework etc. As always, all the links to
these resources will be in the description box below.
1:39 Now, it is really important for you to understand
your options as you're trying to build out your cyber security career, the industry is
massive, as I've mentioned before, and you won't be able to learn everything, at least
not in a short amount of time. So what you want to do is focus on something and both
the skills, get the credentials, etc, to explore that option and get into the workplace in
that way. And that's what we'll be doing today by breaking down the security operations domain.
2:10 Alright, before we dig into this, please remember,
if you like this video, please give it a thumbs up, drop a comment down below, and subscribe
to my channel.
2:18 Alright, let's start by defining what is cyber
security operations. Now, again, security operations is a really big term, it's a really
broad focus area. And there's many different roles that form part of security operations
as a focus area. So in this area, we typically cover the concept of detect, prevent, and
respond. So there you'll have cyber security analysts with the ability to proactively investigate
and detect threats based on alarms that's being raised. That's typically where the security
operation center sits under the Security Operations domain. And then that's typically where you'll
find your same kind of controls, then we'll have the security engineers who will sort
of execute the prevent function of that. So the analyst has alerted us to a potential
malicious detection. And we now need the engineers to go in both the systems implement the systems,
configure the controls, etc, to be able to prevent those attacks in future. And then
we also have the responders that respond to the threat. So if we have a validated threat
in our organization, then we need to have an entire in response team to help us respond
to those incidents. So let's break this down even further.
3:46 And let's talk about detection. With detection,
we're looking to identify a potential threat. So we've got a set of controls in place, this
could be a sim, it could be some form of logging tools, it could be an endpoint detection and
response system where threat hunting can be executed from that we have a set of controls,
and another set of control will have some form of log. And we will have the security
analysts then actively monitoring those logs because there will be behavior that's normal
that we know is known to our organization, this is our IP addresses, this is our indicators,
etc. And and that is all good, normal normal behavior for our organization. And then we
will have the possible malicious indicators. So these could be you know, malicious file
hashes that have been triggered.
4:42 IP addresses you know, we could see some types
of attacks like you know, denial of service attacks, we could see some botnets making
out their communication to the CNC controllers, etc. And that's really typically what the
security analysts will keep an eye on and the security analyst will then be able
4:59 To understand and investigate when something
has triggered, whether it's actually a legitimate threat or not. And it's important to understand
that this cyber security analyst operates before a threat has materialized or has been confirmed.
And it's a really proactive kind of space where the analyst operates to try and understand
whether this could be a potential threat, then stop that threat or the attack if it's
just on one computer or one identity, or in one application, etc. And then try and put
controls in place to prevent that. Now, some of the other tools here that I don't think
is often mentioned, but they're also forms part of the services actually tools like vulnerability
management tools. And and this is also where some of the blue teaming can take place. So
where your ethical hackers would be, because once we identify vulnerabilities, we've got
to understand how relevant and critical it is to our systems in our environment. And
so that's where we have the blue team really come into play, and help us to potentially
try and exploit those threats to see how exploitable it is in our environment. So that we can remediate
those threats when needed, and if a priority as needed. Because if something is a critical
vulnerability, but it doesn't pertain to us, then it's irrelevant. Our business context
is everything. So we've got to understand that there's a larger team here that may not
form part of the soc itself bag, they will be consulted as part of the security operations
in the soc operations. And more often, where we also see some of the red teamers come over.
And they try and exploit the potential vulnerabilities or threats that they find. And then we have
the blue team, trying to actively put in the right kind of controls, to mitigate those
threats identified by the red team. And it's really that, you know, proactive and defense,
kind of offense and defense, kind of prediction and enhancement of our cyber security, defense
side of things. So some of the typical roles that we see here is cyber security analysts,
sock analysts, vulnerability assessors, and sometimes in the soc itself, we also see
some ethical hackers, etc.
7:27 Now, if we're looking at the prevention side,
so this is the configuration that we do, the tools that we implement, actually go about
preventing those attacks. So it's very important that these two things work cohesively, we've
got to be able to predict something, even if we are not able to prevent it. But we work
to find a way to try and prevent it. But visibility is everything right? So visibility is first
prize with everything. And if we can then prevent those attacks that we see, then great.
So we have firewalling infrastructure, we have app gateways, we have endpoint security,
we have application security controls, we really have a lot of controls. And we require
a lot of different skill sets and understanding of a whole lot of different platforms to be
able to really execute on the security engineering, implementation of controls, configuration
of controls, maintaining the controls, etc. And the roles that we typically see in here
would be network security engineers, you know, that would maybe operate at controls on the
network layer, application security engineers, Dev SEC ops type of professionals, we also
see endpoint and system engineers that operate at the level of system security.
8:52 So on the preventative side, more often, we
see the engineering staff complement that, you know, configuring the systems enhance the
systems and get our controls in place to prevent the attacks in the future. So then from the response
side. So this is in a case where the attack might have been a zero day type attack. So
never been seen before. No IOC s and it passed through our detection controls without alerting
the sock analysts. Or it has alerted the sock analysts but it's widespread and it's now
an actual incident in our organization. And here is where the incident response comes
into effect. Now, incident response is not just for a scenario where there is a massive
incident and the organization is shutting down business operations and they need to
respond to an incident we actually have day to day incident responders as part of the
sock as well to investigate you know, email threads, email compromises, etc. Because if
we can Then how a small compromise happens, then it helps us to understand whether that
small compromise which was a part of a larger attack chain, and it helps us to then better
enhance our detection controls.
10:13 So you have incident responders that form
part of the sock team. And then you have incident responders that come from the outside and
help us respond to threats. And most of the time we see in larger businesses, they may
have an entire incident response team with, you know, incident response analyst, forensic
investigators, etc. And then we also see that in smaller organizations, this might be a
function that they rely on a third party for. And so we really require highly skilled incident
responders, forensic investigators, malware, analysts, malware, reverse engineers, etc,
to be able to help us with the function of responding to an incident. And here, what
we want to achieve is really to contain the threat that we've observed, eradicate that
threat, and make sure we can return our business processes to normal after an incident.
11:09 Alright, so do you have to be technical to
work in the security operations area? And here largely, the answer is going to be yes.
From an analyst perspective, we require, you know, basic cyber security knowledge and understanding.
From an engineer perspective, we require really a bit more advanced skills. And as I've mentioned,
looking at the layered approach or defense in-depth, you'll have firewalls, applications
in points, systems, etc, to secure and so it's not expected that you need to work across
the spectrum. So if you want to, you know, focus and soul into being a network security
engineer, then definitely go and learn the networking components first and understand
that first, even within the domain of security operations, you're still going to have to
understand what is it that you want to do? So do you want to be in the defense side as
a cyber security analyst, you're gonna be in the preventative side more to the engineering
side? Or do you want to be on the response side, so incident responders etc. And for
the incident response side, there may be more type of coding and analysis kind of experience
because you would need to do some form of reverse engineering to understand you know,
what that malware does, how that threat actually executes on systems etc. There is a lot of
focus on technical skills in the security operations domain.
Alright Friends, that is it for this video. I hope that you found it informative.
In the next video I will be covering threat intelligence as a focus domain.
If that is something that you are interested in definitely Subscribe,
To make sure not to miss that video.
Catch you next time. Bye