Security Operations in Real Life

Security Operations in Real Life

• A strong reputation takes 20 years to build, but a cyber incident can ruin it in minutes. (Stephane Nappo quote)

Small Company Security

• Often, there's no dedicated security team.
• Frequently, security is handled by one person in the IT department.
• Security is sometimes perceived as unimportant.
• Focus is usually on backups and authentication.
• Pros: at least one person who understands security.
• Cons: lack of knowledge and experience in one person.

Taking Security Seriously

• Security is often prioritized after a security incident or audit.
• Common issues preceding incidents include minimal budgets and resources.
• Lack of respect for security is a common challenge. (e.g., "why should we care about security?")

Medium-Sized Company Security

• A small, general-purpose security team often handles operational tasks, infrastructure, and applications.
• Security is sometimes not a prioritized aspect and nobody excels at everything.
• Can be a bigger issue after security breeches.
• Pros: dedicated security team.
• Cons: Budget constraints and limited security expertise.

Big Company or Large Enterprises

• Big companies have dedicated teams or departments for security, potentially spanning multiple domains (e.g., privacy).
• Not all teams/personnel are solely focused on security.
• Pros: detailed expertise, potentially dedicated budgets.
• Cons: high security costs and slower innovation.

Examples of Focused Security Subteams

• Security Engineering
• Security Architecture
• Security Operations Center
• Application Security
• Pentesting Team
• Security Consulting Team
• CISO (Chief Information Security Officer)

Security Architecture

• Defines security policies, standards, and procedures.
• Ensures modern technologies conform to current standards.
• Performs risk assessments to minimize threats.
• May focus on operations, applications, or products.

Security Engineering

• Develops tools, techniques, and methods that resist malicious attacks, helping protect systems and data.
• Builds SIEM (Security Information and Event Management) using tools like ELK (Elasticsearch, Logstash, Kibana), Splunk, OSSEC, etc..
• Implements FIM (File Integrity Monitoring) using utilities like Qualys, Tanium, LogRhythm
• Also includes Network Segmentation (Palo Alto, Cisco, or Illumio).
• Can include (Micro)Services management (e.g., container security) tools.

Security Operations Center (SOC)

• 3,950 breaches occurred in 2020.
• 72% of breaches affected large businesses.
• 28% of breaches affected small/medium-sized businesses.
• 43% of breaches targeted web applications.
• Average cost of a large breach is $392 million.

SOC - Key Objectives

• Manages and coordinates cyber threat and incident responses.
• Monitors cybersecurity posture and reports deficiencies.
• Correlates system/application/network logs in a consistent manner.
• Performs threat and vulnerability analysis.
• Analyzes cybersecurity events.
• Maintains a database of cyber security incidents.
• Provide alerts and notifications of general or specific threats.
• Provides regular reporting to management.

SOC - More Key Objectives

• Automate compliance, vulnerability assessments, and risk management.
• Ensure change control is integrated into the SOC process.
• Provide identification of security attack vectors and incident classification.
• Define disaster recovery plans (ICE) in case of emergency.
• Build a comprehensive dashboard with metrics aligned to security metrics.
• Proactive security monitoring based on pre-defined metrics/KPIs

SecOps processes

• Secure change management lifecycle (request/impact analysis/implementation/approve/deny).
• Security design review (operations view) aspects including justification, use cases, environments, diagrams, network/user control, data sensitivity, security architecture, logging/auditing, vulnerability management, business continuity, and secrets management).
• DevSecOps concept
• DevOps lifecycle with automated functions for compliance assessment, vulnerability management, and risk management.
• Software defined Data Centers (AWS, Azure, Google Cloud, OCI) with security driven code (Ansible, Terraform).
• Examples of security frameworks.

CIS Controls v8 (formerly SANS Top 20)

• Focuses on security activities rather than personnel.
• Contains 18 controls.
• Addresses critical business processes and activities.
• Provides 153 safeguards grouped into implementation groups (IG1/2/3).
• Maps security to well-known frameworks (CSF, ATT&CK, CSA, PCI, SOC2...).

Another Security Framework

• The Cybersecurity Framework (NIST) focuses on cybersecurity outcomes in a hierarchical format.
• It encompasses core, profiles, and implementation tiers (levels of risk management practices).

Key Framework Attributes

• Common language for accessibility and adaptability.
• Adaptable to various technologies and lifecycle phases across diverse sectors.
• Risk-based methodology accounting for international standards.
• A living document that is subject to ongoing guidance.
• Perspectives of various stakeholders (private sector, academia, public sector) are considered.

The Framework Core

• Describes desired cybersecurity outcomes understandably by all.
• Applies to all risk management situations.
• Covers the entirety of cybersecurity considerations including prevention and response.

An Excerpt from the Framework Core

• Provides details on the function, categories, subcategories, and informative references for the interconnected framework's outcomes.

Implementation Tiers

• A method of quantifying cybersecurity risk management practices by measuring the level of risk awareness, implementation, and responsiveness.

Incident Example: SolarWinds

• Security firm FireEye released a blog post about the UNC2452 group hacking SolarWinds.
• SolarWinds, an IT firm, possibly suffered a sophisticated attack affecting 18,000 companies, governments, and other entities.
• Their network management product, Orion, was a critical component and was used in several sensitive settings.

The Vector

• SolarWinds is a software company, and their network management product Orion in particular, was a vector of the attack because of its use in sensitive areas.

The Targets

• SUNBURST malware was targeted to specific deployments.
• It was designed to only activate if installed in certain locations.
• Attack only happened in certain areas.

Attack Timeline

• Timeline detailing the events of the attack, including when the harmful code was injected and deployed.

Attacker's Traits

• Attackers were sophisticated, cleaning up traces and hiding themselves skillfully, utilizing secure servers to enhance their strategy.
• Minimal target selection, likely focused on organizational interest rather than large-scale financial gain.
• Limited evidence of data destruction or ransomware actions or financial gain. No evidence of personnel information theft.

Nobody Likes Compliance but it is Important

• Compliance is usually disliked, but is required due to legal and regulatory requirements and is essential for passing audits and managing internal standards and best practices.

Risk Management

• Diagrams illustrating the different types of cybersecurity risks (high probability/low/high impact).

MITRE ATT&CK

• Categorizes adversarial behaviours for offensive and defensive activities.
• Offers a standard classification scheme for better threat understanding and response planning.
• Provides a customizable knowledge base across enterprise, mobile, and broader frameworks.