CSOC Board Notes PDF

An **Access Control List (ACL)** is a set of rules that controls network traffic by specifying which users or systems can access certain network resources. ACLs filter traffic to block unauthorized access and prevent malicious activity, making them essential for network security. AES is one of the...

An **Access Control List (ACL)** is a set of rules that controls network traffic by specifying which users or systems can access certain network resources. ACLs filter traffic to block unauthorized access and prevent malicious activity, making them essential for network security. AES is one of the most widely used encryption standards and is the successor to the Data Encryption Standard (DES). It is a **symmetric-key** algorithm, the same key is used for both encryption and decryption. **Assured Compliance Assessment Solution (ACAS)** is a cybersecurity tool used by government agencies and defense contractors for vulnerability scanning, compliance management, and continuous monitoring. It identifies and manages vulnerabilities to help secure sensitive systems and ensure regulatory compliance. **Common Vulnerabilities and Exposures (CVE)** is a database of identified cybersecurity vulnerabilities, each assigned a unique ID. Managed by MITRE, CVE standardizes vulnerability tracking, helping organizations identify and address security issues across systems and software. COOP (Continuity of Operations Plan)**:** A set of instructions detailing how an organization will sustain its essential functions within 12 hours and for up to 30 days following a disaster, before returning to normal operations.  **Defense Information Systems Agency (DISA)**U.S. Department of Defense agency that provides secure IT and communications support for military and government operations, focusing on secure global networks and cybersecurity. **Firewall** is a security device or software that monitors and controls network traffic based on predefined rules, acting as a barrier between trusted internal networks and untrusted external networks. **JRSS (Joint Regional Security Stack)** is a cybersecurity initiative used by the U.S. Department of Defense (DoD) to enhance network security and improve visibility and control over data traffic across its global enterprise. **Role-Based Access Control (RBAC)** is a security model that restricts system access based on the roles of individual users within an organization. RBAC assigns permissions to roles rather than to individual users, streamlining the management of user privileges. RSA **(Rivest-Shamir-Adleman)** is an **asymmetric-key** encryption algorithm, meaning it uses a pair of keys: a **public key** for encryption and a **private key** for decryption. **Security Information and Event Management (SIEM)** system collects and analyzes security data from across an organization\'s IT infrastructure. It centralizes logs from various sources, enabling real-time monitoring, threat detection, and incident response. SIEM solutions help organizations enhance their cybersecurity posture by providing visibility into security events and facilitating compliance reporting. **Security Technical Implementation Guides (STIGs)** cybersecurity guidelines from (DISA) designed to secure DoD systems. Provides detailed instructions for configuring hardware and software, ensuring systems are \"hardened\" against cyber threats by meeting compliance and reducing vulnerabilities. STIGs are a part of the DoD's Risk Management Framework and are updated regularly to counter new security risks. **SOAR** stands for **Security Orchestration, Automation, and Response**. It refers to a category of security solutions designed to improve the efficiency and effectiveness of security operations by automating and orchestrating responses to security incidents. A **TAP** (Terminal Access Point) is a network device or technology used primarily in network monitoring and security. It is designed to facilitate the capture and analysis of network traffic without disrupting the normal operation of the network. Triple DES is a **symmetric-key** encryption algorithm that applies the original DES encryption algorithm three times to each data block. It was developed to improve the security of DES, which became vulnerable due to its relatively short key length. **Virtual Private Network (VPN)** is a technology that creates a secure and encrypted connection over a less secure network, such as the internet. VPNs are commonly used to protect private web traffic from snooping, interference, and censorship. **Web content filtering** is a cybersecurity tool that restricts access to certain websites or types of content based on predefined criteria. Organizations use it to enhance security, comply with regulations, and improve employee productivity by blocking distracting or inappropriate sites. **Encryption Standard** **Type** **Key Lengths** **Use Cases** **Strength** ------------------------- ----------------------------------- ---------------------------- -------------------------------------------------------- ------------------------------------------------- AES Symmetric 128, 192, 256-bit Data at rest, VPNs, file encryption Highly secure and efficient RSA Asymmetric 2048, 4096-bit Digital signatures, SSL/TLS, email encryption Strong but computationally intensive 3DES Symmetric 168-bit (3x56-bit DES) Legacy systems, secure payments Secure but deprecated due to slower performance ECC Asymmetric 256, 384-bit (smaller) SSL/TLS, mobile encryption, cryptocurrency Efficient and secure with shorter key lengths Blowfish Symmetric 32 to 448-bit Password management, secure file storage Fast but superseded by newer algorithms Twofish Symmetric 128, 192, 256-bit Disk encryption, open-source software Secure and efficient DES Symmetric 56-bit Legacy systems Deprecated due to vulnerability SHA-256 Cryptographic Hash Fixed 256-bit Integrity verification, blockchain, digital signatures Highly secure for hashing TLS Protocol (Symmetric + Asymmetric) Various (AES + RSA or ECC) Secure communication, web browsing (HTTPS), VPN Standard for secure data in transit **Feature** **Snort** **Suricata** **YARA** ------------------------- ------------------------------------------------------------------ ------------------------------------------------------------ ------------------------------------------ **Primary Use** Network IDS/IPS Network IDS/IPS/NSM Malware identification **Traffic Analysis** Real-time network traffic analysis Real-time network traffic analysis Static analysis of files and samples **Rule Syntax** Snort-specific rule syntax Compatible with Snort rules + extensions YARA-specific rule syntax **Performance** Generally single-threaded (less efficient on multi-core systems) Multi-threaded (better for high-throughput) N/A (file scanning, not real-time) **Protocol Support** Limited protocol decoding Extensive multi-protocol support N/A (file-centric) **Additional Features** Basic application-layer detection Advanced features like file extraction, HTTP logging, etc. Complex logic for malware classification **COMDTINST M2620.2 -- Cyberspace Operations Manual** **COMDTINST M2620.2** is the U.S. Coast Guard\'s **Cyberspace Operations Manual**, which provides essential guidance on managing cyberspace operations and cybersecurity within the organization. **Key Highlights:** - **Mission Alignment**: Emphasizes the role of cyberspace operations in supporting the Coast Guard\'s mission. - **Roles and Responsibilities**: Clarifies the accountability of personnel involved in cybersecurity efforts. - **Risk Management**: Offers guidelines for assessing and managing cyber risks. - **Incident Response**: Details procedures for responding to cyber incidents and recovery strategies. **CJCSM 6510.01 -- Cyber Incident Handling Manual** **\ CJCSM 6510.01** is the **Cyber Incident Handling Manual** from the Chairman of the Joint Chiefs of Staff, providing essential guidelines for managing cyber incidents in U.S. military and government networks. **Key Components:** - **Detection and Reporting**: Procedures for recognizing and reporting cyber incidents promptly. - **Response and Recovery**: Processes for mitigating impacts and restoring operations quickly. - **Roles and Responsibilities**: Defines stakeholder roles in incident management. - **Training and Exercises**: Highlights the need for training to prepare personnel for effective response. **DODD8530.01 -- Cybersecurity Activities Support to DODIN Operations** **DODD 8530.01** is the Department of Defense Directive that outlines the framework for cybersecurity activities in support of Department of Defense Information Network (DODIN) operations. This directive establishes policies, responsibilities, and procedures for protecting DOD information systems and networks. **Key Components:** 1. **Cybersecurity Framework**: Defines the structure for cybersecurity activities, including risk management, compliance, and incident response. 2. **Responsibilities**: Clarifies the roles of various DOD components in implementing and maintaining cybersecurity measures. 3. **Integration with Operations**: Ensures that cybersecurity practices are integrated into DODIN operations to enhance overall network security and resilience. 4. **Training and Awareness**: Stresses the importance of training personnel to recognize and respond to cybersecurity threats effectively. **COMDTINST M5500.13 -- Cybersecurity Manual** **COMDTINST M5500.13** is the **Cybersecurity Manual** of the U.S. Coast Guard, which provides comprehensive guidance on establishing and maintaining cybersecurity within the organization. This manual outlines policies, procedures, and best practices aimed at protecting Coast Guard information systems and networks from cyber threats. **Key Components:** 1. **Cybersecurity Policies**: Establishes a framework for implementing cybersecurity measures across the Coast Guard, ensuring compliance with federal standards and regulations. 2. **Risk Management**: Emphasizes the importance of identifying, assessing, and mitigating risks associated with information systems and data. 3. **Roles and Responsibilities**: Clearly defines the roles of personnel involved in cybersecurity, including responsibilities for security assessments and incident response. 4. **Incident Response and Reporting**: Provides protocols for responding to cybersecurity incidents, including reporting mechanisms to ensure timely action and recovery. **CGCYBERINST 2620.1 -- Incident Response Plan** **CGCYBERINST 2620.1** is the **Incident Response Plan** for the U.S. Coast Guard, which outlines procedures and protocols for effectively responding to cybersecurity incidents. This plan aims to ensure that Coast Guard personnel can identify, assess, and mitigate the impacts of cyber incidents on their operations and information systems. **Key Components:** 1. **Incident Detection and Reporting**: Establishes procedures for detecting and reporting cybersecurity incidents in a timely manner. 2. **Response Procedures**: Details the steps to be taken during various types of incidents, including containment, eradication, and recovery. 3. **Roles and Responsibilities**: Defines the responsibilities of Coast Guard personnel involved in incident response, ensuring clear accountability. 4. **Training and Exercises**: Highlights the importance of regular training and simulation exercises to prepare personnel for effective incident handling. **CSOC DCO Watch Process Guide** The **CSOC DCO Watch Process Guide** outlines the procedures and protocols for the **Cybersecurity Operations Center (CSOC)** in conducting **Defensive Cyber Operations (DCO)**. This guide serves as a framework for monitoring, detecting, and responding to cyber threats against organizational networks. **Key Components:** 1. **Monitoring and Detection**: Establishes continuous monitoring processes to detect potential cyber incidents and anomalies in network traffic. 2. **Incident Response**: Provides guidelines for immediate action when a cyber incident is identified, including escalation procedures and communication protocols. 3. **Threat Intelligence**: Integrates threat intelligence to enhance situational awareness and inform decision-making during DCO operations. 4. **Reporting and Documentation**: Emphasizes the importance of documenting incidents and responses for future analysis and improvement of cybersecurity measures. 5. **Collaboration**: Encourages coordination among various teams and agencies to ensure a comprehensive approach to incident response and recovery. **USCG Strategic Plan 2018-2022** The **USCG Strategic Plan 2018-2022** outlines the priorities and objectives of the U.S. Coast Guard to enhance its operational effectiveness, mission readiness, and resilience. The plan emphasizes the importance of adapting to evolving threats, improving partnerships, and leveraging technology to meet its strategic goals. **Key Components:** 1. **Mission Focus**: The plan reiterates the Coast Guard\'s commitment to its core missions, including maritime safety, security, environmental protection, and law enforcement. 2. **Operational Excellence**: It emphasizes the need for continuous improvement in operational capabilities, readiness, and response times. 3. **Innovation and Technology**: The Coast Guard aims to integrate new technologies to enhance efficiency and effectiveness in operations. 4. **Workforce Development**: There is a strong focus on investing in personnel through training and development to ensure a skilled and adaptive workforce. 5. **Collaboration and Partnerships**: Strengthening partnerships with federal, state, local, and international agencies is vital for enhancing mission success. **Importance:** This strategic plan serves as a roadmap for the Coast Guard to navigate challenges and leverage opportunities in a rapidly changing maritime environment, ensuring it remains capable of fulfilling its diverse missions. **USCG Cyber Strategic Outlook** The **USCG Cyber Strategic Outlook** outlines the U.S. Coast Guard\'s vision for addressing cybersecurity challenges and enhancing its capabilities in the cyber domain. This document emphasizes the importance of protecting critical maritime infrastructure and ensuring operational readiness against cyber threats. **Key Components:** 1. **Vision and Goals**: The outlook establishes a clear vision for achieving cybersecurity resilience, focusing on the protection of Coast Guard operations and assets. 2. **Risk Management**: It emphasizes a proactive approach to risk management, identifying potential vulnerabilities in systems and networks and implementing measures to mitigate these risks. 3. **Collaboration and Partnerships**: The strategic outlook highlights the need for collaboration with other federal, state, and private sector partners to enhance cybersecurity efforts and share information effectively. 4. **Innovation and Technology**: There is a strong focus on leveraging emerging technologies to improve cybersecurity capabilities and adapt to evolving threats. 5. **Workforce Development**: The document underscores the importance of training and developing personnel to ensure they are equipped to handle cyber challenges effectively. **Importance:** The USCG Cyber Strategic Outlook serves as a roadmap for the Coast Guard to navigate the complex cybersecurity landscape, ensuring that it can fulfill its mission in an increasingly digital world. **USCG Cyber Strategy** The **USCG Cyber Strategy** outlines the U.S. Coast Guard\'s approach to strengthening its cybersecurity posture and resilience in the face of evolving cyber threats. This strategy is a critical component of the Coast Guard\'s overall mission to protect the maritime domain and ensure national security. **Key Components:** 1. **Mission Assurance**: The strategy emphasizes the importance of ensuring the security and operational integrity of Coast Guard missions, including safety, security, and environmental protection in the maritime environment. 2. **Cyber Risk Management**: It focuses on a comprehensive approach to identifying and mitigating cyber risks, integrating risk management practices into operational planning and execution. 3. **Collaboration and Partnerships**: The strategy highlights the necessity of collaboration with federal, state, local, and international partners, as well as the private sector, to enhance cybersecurity capabilities and share vital information. 4. **Innovation and Technology**: It encourages the adoption of emerging technologies and innovative solutions to improve cybersecurity defenses and responses to threats. 5. **Workforce Development**: The strategy underlines the need for ongoing training and development to equip Coast Guard personnel with the skills necessary to address cyber challenges effectively. **Importance:** The USCG Cyber Strategy serves as a roadmap for the Coast Guard to enhance its cybersecurity efforts, ensuring that it can effectively protect its operations and critical infrastructure in a rapidly changing digital landscape. **JRSS Tools**\ **InfoVista:** provides real-time and historical insights into network traffic to optimize performance and troubleshoot issues **Netcool:** tool for network and event management, allowing teams to detect, isolate, and respond to network incidents in real-time. It provides visualization and integration with other IT management tools **Moveit**: A secure file transfer software solution that enables encrypted, automated file transfers with compliance capabilities, especially useful for sensitive data **Cyber Chef:** web-based tool for data analysis and manipulation, often used in cybersecurity for encoding, decoding, encrypting, and decrypting data **IBOSS:** Cloud-based secure web gateway providing web filtering, data loss prevention, malware protection, and more. It helps control user access to the internet while ensuring data security. **Cisco Security Manager:** Manages Cisco security devices, streamlining configuration and monitoring of security policies across networks **F5:** Primarily known for application delivery and load balancing, F5 solutions also include web application firewalls, traffic security, and secure access capabilities **NikSun:** Provides real-time network monitoring and analysis with zero-loss packet capture, useful for root-cause investigation and compliance monitoring **PaloAlto:** Next-generation firewalls (NGFWs) offering capabilities like application visibility, malware prevention, and advanced threat detection. **TippingPoint**: An Intrusion Prevention System (IPS) that proactively blocks malicious network traffic based on real-time analysis **Stealthwatch**: A Cisco solution for network visibility and advanced threat detection, allowing security teams to detect anomalies and potential security breaches\ \ **On Premises Security** (On site) CGESS\ **Cortex/Xpanse**- Palo Alto Networks' attack surface management tool that identifies and monitors exposed assets and vulnerabilities on a network\ **Cate**- Cyberspace Analyst Tactical Enclave (perform forensic investigations) (Access forensic files, create VM, transfer files for forensics)\ **Elastic**- Elastic Stack provides centralized logging, monitoring, and alerting capabilities. Commonly used for security information and event management (SIEM). Elastic SIEM provides a centralized view for analysts to monitor, analyze, and respond to cyber threats in real time, while maintaining a historical audit trail. Client systems use Winlogbeat and Filebeat to send data to SIEM.\ **Riverbed-** Network and application performance monitoring tool that helps optimize and troubleshoot network performance across locations\ **Source Fire**- Cisco's Next-Gen Intrusion Prevention System (NGIPS) that inspects traffic and detects and prevents threats.\ **Swimlane** -- A Security Orchestration, Automation, and Response (SOAR) platform that integrates with security tools to streamline incident response workflows.\ **Tanium**- Endpoint management tool used for visibility and control over large numbers of endpoints to ensure security and compliance. **HBSS/ Trelix** Endpoint security suite that includes host-based intrusion detection/prevention systems (HIDS/HIPS) for threat detection and prevention.\ **Firewall/DNS**: firewalls that manage and secure network traffic and DNS tools that control domain name resolution, critical for network security. **Cloud Security Tools\ **\ **AWS**: Amazon Web Services provides a suite of cloud security tools, including network security, data protection, and compliance solutions. AWS offers on-demand cloud computing and APIs on a pay-as-you-go basis, providing processing capacity and software tools through server farms. This includes Amazon EC2, a virtual computer cluster.\ **Coastal**- COASTAL is CSOC\'s Big Data Protocol (BDP) solution for long-term log storage. IS will be responsible for verifying data integrity, creating documentation and working with SIEM admins to make sure COASTAL meets our requirements for a long-term storage solution.\ **CBII:** Menlo Security\'s Cloud-Based Internet Isolation, which isolates internet traffic away from the endpoint, protecting against web-based threats.\ **MD**: **(Microsoft Defender)** Microsoft's antivirus and endpoint protection solution that includes malware protection, identity monitoring, and data privacy controls. **MDI**: **(Microsoft Defender for Identity)**: Identity protection service focused on detecting identity-related threats like compromised accounts or insider threats.\ **MPurview**: Data governance tool for securing and managing data across an organization's digital estate, enhancing visibility and compliance.\ **MSentinel**: Microsoft's cloud-native SIEM and SOAR platform providing threat intelligence, incident response, and analytics across the network.\ **TippingPoint**: While traditionally on-premises, TippingPoint can integrate into cloud environments for intrusion prevention in hybrid cloud networks. IS IPS Tools: IS IDS Tools: