CyberSecurity SOCs building proposal

CyberSecurity SOCs building proposal

                                         Trevor Shi version 1.0  10/02/2019

1.      Long-term goal

Establish the security operation centers and build a Computer Security Incident Response Team (CSIRT).

Establish the Security operations centers to monitor and analyze networks, servers, endpoints, databases, applications, websites, and other systems looking for anomalous activity that could be indicative of a security incident or compromise. The SOC is responsible for ensuring that potential security incidents are correctly identified, analyzed, defended, investigated, and reported.

Build a Computer Security Incident Response Team (CSIRT) to detect, analyze, and respond to cybersecurity incidents using a combination of technology solutions and a strong set of processes. 

2.      Short-term goal

2.1.   Establish the network monitoring center (NMS)

2.1.1.      Monitoring network equipment performance

2.1.2.      Monitoring network traffic

2.1.3.      Collecting and analyzing the network equipment logs

2.2.   Establish security operation centers (SOCs)

2.2.1.      Monitoring cybersecurity equipment performance

2.2.2.      Security monitoring

2.2.3.      Intrusion Detection

2.2.4.      Incident Response

3.      Essential SOC capabilities

The essential security monitoring tools to build a SOC include Asset Discovery, Vulnerability Assessment, Intrusion Detection, Behavioral Monitoring, and SIEM / Security Analytics.

3.1.   Asset Discovery

what systems exist (instances and servers) as well as what’s been installed and running on those systems (e.g. applications, services, and active ports).

3.2.   Vulnerability Assessment

3.3.   Behavioral Monitoring

3.3.1.      Network monitoring

3.3.2.      Security monitoring

3.4.   Intrusion Detection

3.4.1.      NIDS

3.4.2.      HIDS

3.4.3.      CIDS

3.5.   Log Servers and SIEM

3.5.1.      Commercial version: Splunk

3.5.2.      Open-source

3.5.2.1.            grafana

Metric database, a monitoring solution, Grafana is designed for analyzing and visualizing metrics such as system CPU, memory, disk and I/O utilization.

3.5.2.2.             ELK

Log collection sets, a log analysis solution including ElasticSearch, Logstash, and Kibana

3.5.3.      Splunk the free version(500mb logs limit per day, manual upload data)

3.6.   Anti-virus and Anti-malware

4.      Time schedule

4.1.   The first stage goal

4.1.1.      Understanding the environment

4.1.2.      Identify and scope out a Service and SOC service functions

4.1.3.      Anti-virus config

4.1.3.1.            Make computers show up in the management center

4.1.3.2.            License

4.1.4.       Firewall

4.1.4.1.            Add the other two firewalls to the management center  

4.1.5.      Set-up log servers

4.1.5.1.            Graylog

4.1.5.2.            Logstash

4.1.6.      Configuring Log servers to receive raw data

4.1.7.      Create the weekly security report sample

4.2.   The second stage goal

4.2.1.      Set-up network monitoring environment

4.2.1.1.            Grafana

4.2.2.      Set-up SIEM

4.2.3.      Configuring SIEM to receive raw security-relevant data

Firewall/IPS/IDS

Database server/file server/domain controller/dns/email/web/active directory

4.2.4.      Base on security policy, create Security Checklist (monthly and yearly)

4.3.   The third stage goal

4.3.1.      Vulnerability Assessment

4.3.2.      Patching processes

4.3.3.      Establish a honey pot environment

4.4.   The fourth stage goal

4.4.1.      Establish cybersecurity Lab

4.4.2.      Pentesting