LinkedIn - Posts
LinkedIn - Posts
Posted
Post X1
SANS - Guide to security operations
https://sansorg.egnyte.com/dl/TLpDjvybnc
๐ Guide to Security Operations By SANS Institute ๐
๐ Contents:
๐ SOC Functions
๐ฏ SOC Functions Diagram
๐ SOC Core Functions
๐ก๏ธ Collection
๐ฆ Detection
๐จ Triage
๐ Investigation
๐ ๏ธ Incident Response
โ๏ธ SOC Auxiliary Functions
๐ ๏ธ SOC Tools
๐ ๏ธ SOC Tools Overview
๐ SIEM
๐ Threat Intelligence Platform
๐ Incident Management System
๐ Collection of Key Data
๐ Data Types
๐ Flow Records
๐ณ Transaction Data
๐ฆ Full Packet Capture
๐ Traffic Collection Opportunities
๐ป Endpoint Monitoring
๐ Event Categories to Record and Collect
๐ข Windows Log Sources
๐ง Linux/Unix Log Sources
โ๏ธ Cloud Logging
๐ข IaaS Logging
โ๏ธ Cloud Management Plane Logs
๐ฆ PaaS and SaaS Logging
๐ Models & Metrics for Security Operations
๐ก๏ธ Attack Mental Models and Reference Frameworks
๐ฏ Knowing Yourself and Your Enemy
๐ฏ Three Levels of Threat Intelligence
๐ฏ Threat Modeling
๐ฏ Attack Trees
๐ฏ F3EAD Cycle
๐ The OODA Loop
๐ The OODA Loop and Operations Tempo
๐ Threat-Hunting
๐ Metrics
๐ Metrics Types
๐ Practical Metrics Considerations
๐ What to Measure
๐ SOC References
๐ง Open-Source Tools
๐๏ธ Podcasts
๐ Books
๐ Suggested SANS Courses for the Blue Team
๐ SANS Free Resources
๐ About the Author
#SecurityOperations #Cybersecurity #SIEM #CyberDefense #Infosec
Post X4
Getting Started with MITRE ATT&CK
๐ Contents:
๐ Threat Intelligence
๐ Detection and Analytics
๐ต๏ธโโ๏ธ Adversary Emulation and Red Teaming
๐ง Assessments and Engineering
#cybersecurity #informationsecurity #mitreattack
Post X5
๐ Microsoft Azure Security Framework - A roadmap for hardening the security of your Azure environment ๐ก๏ธ
๐ Contents:
๐ Introduction: Securing Azure
๐ Inventory management
๐ผ Resource isolation
๐ Backups and disaster recovery
๐ Identity and access management
๐ Logging and monitoring
๐ Policies
๐ Resource governance
๐ต๏ธโ Continuous detection and monitoring
๐จ Incident response (IR)
#AzureSecurity #CloudSecurity #MicrosoftAzure #Cybersecurity #DataProtection #InfoSec #Azure #SecurityFramework
Post X7
๐ Microsoft 365 Forensics Playbook - Best Practices for Acquisition of Email boxes and Unified Audit Logs For Microsoft 365 (Exchange Online) ๐ฆ๐
๐ Contents:
๐ต๏ธโ eDiscovery Roles
๐ Role assignment
๐ Create an eDiscovery case
๐ฆ Reserving content in legal hold
๐ Carrying out eDiscovery content search
๐ค Export of Mailbox in PST
๐ Unified Audit Logs
#Microsoft365 #Forensics #Cybersecurity #IT
Post X8
๐ RISK ASSESSMENT PROCESS HANDBOOK ๐
๐ Contents:
Overview
- Aim of the handbook
- Benefits of the risk assessment process
- The QERMF's approach to managing risk
Risk Assessment Process:
- Establishing the context
- Analyzing hazards
- Assessing risk
- Risk based planning
Risk Assessment Process Details:
- Process 1: Identifying risk
- Step 1: Assessing the hazard
- Step 2: Identifying exposed elements
- Step 3: Assessing vulnerability
- Process 2: Determining level of risk
- Step 1: Assessing likelihood
- Step 2: Finalizing vulnerability assessment
- Step 3: Assessing consequence
- Risk statement development
- Assigning level of risk
- Risk treatment
- Risk documentation
- Risk Assessment Table
- Risk Register
- Decision Log
#Cybersecurity #RiskAssessment #RiskManagement
Post X9
๐ Malware Reverse Engineering Handbook ๐ต๏ธโ
๐ Contents:
๐ Why Perform Malware Analysis?
๐ฌ How to Set Up a Lab Environment
๐ป Static Malware Analysis
๐ Disassembly (IDA & Ghidra)
๐ Dynamic Analysis
๐ Network Traffic Analysis
๐ฆ Packed Executables/Unpacking
๐จ Incident Response Collaboration (MISP & Yara)
#MalwareAnalysis #ReverseEngineering #Cybersecurity #InfoSec #DigitalForensics
Post X10
The Zero Trust Model in Cybersecurity
๐ Contents:
Why zero trust โ and why now? ๐
Decoding zero trust: giving a meaning to the buzzword ๐ต๏ธโโ๏ธ
What is not zero trust? And what is? ๐ค
Limitations and possibilities of zero trust in an industrial environment ๐ญ
Guiding principles of zero trust โจ
Best practices and steps for a successful deployment of the zero-trust model ๐
Ensuring buy-in across the organization with tangible impact ๐ผ
Understanding and mapping the โcrown-jewelsโ ๐
Introducing adequate control mechanisms ๐
Implementing the zero trust model ๐ป
Maintaining, monitoring and improving the zero trust model ๐
Vision for the future: new technologies and zero trust ๐ฎ
#ZeroTrust #Cybersecurity #InfoSec #CyberDefense
Post X11
Risk Assessment and Treatment Process
๐ Contents:
Risk assessment and treatment process
- Criteria for performing information security risk assessments
- Risk acceptance criteria
- Process diagram
- Establish the context
Risk identification
- Compile/ maintain asset inventory
- Identify potential threats
- Identify risk scenarios
Risk analysis
- Assess the likelihood
- Assess the impact
- Risk classification
Risk evaluation
- Risk assessment report
Risk treatment
-
Risk treatment options
-
Select ion of controls
-
Risk treatment plan
-
Statement of applicability
-
Management approval
-
Risk monitoring and reporting
-
Regular review
Roles and responsibilities
- RACI chart
Post X12
Tenant Isolation Framework for Cloud Applications by @Wiz
๐ Contents:
Part One โ Modeling Tenant Isolation
- External Interfaces
- Security Boundaries
- Hardening Factors
- Isolation Review
- Vendor Transparency
Part Two โ Improving Tenant Isolation
- Core Principle
- Additional Considerations
- Isolation Maintenance
Post X13
Windows Event Log Analysis
๐ Contents:
Event Log Format๐
Account Management Events๐
Account Logon and Logon Events๐ค
Access to Shared Objects๐
Scheduled Task Loggingโฐ
Object Access Auditing๐
Audit Policy Changes๐
Auditing Windows Services๐ง
Wireless LAN Auditing๐ถ
Process Tracking๐
Additional Program Execution Logging๐
Auditing PowerShell Use๐ป
#LogAnalysis #Cybersecurity #WindowsSecurity #InformationSecurity
Post X15
Warning: Port 514 - Your Network's Vulnerable Backdoor (BONUS INSIDE) ๐๐ฅ
Last week, my team flagged a critical issue: a client had integrated a SIEM system into the cloud, and it raised some serious concerns. I decided to get to the bottom of it.
I talked to the client, hoping to understand how they had done the integration and what precautions they had taken. Unfortunately, they couldn't provide clear answers, so I took matters into my own hands.
Here's what I found:
-
Uncontrolled Alerts: The client's SIEM system had no alert controls, and there were no defined rules in place.
-
Unencrypted Data Transfer: Some integrations were transmitting data over port 514 without encryption.
3.Open Port 514 to the Internet: The most glaring issue was that port 514, used for the SYSLOG service of the SIEM system, was wide open to the Internet.
When I confronted the client with these findings, they seemed baffled by the significance of an open port 514 to the SYSLOG server on the Internet.
I had to spell it out for them: an open port 514 accessible from the Internet exposes you to significant security risks, including:
-
Denial of Service (DoS) Attacks: Malicious actors could flood the server with an overwhelming volume of logs, potentially crippling the SIEM system.
-
False Logs: Unauthorized access to the SYSLOG server could lead to the injection of false or misleading log data, causing confusion or even misdirected responses.
-
Financial Impact: If data transmission is billable, excessive traffic from untrusted sources could lead to substantial financial losses.
In response to these critical findings, we promptly convened a meeting with the client and their service provider, successfully mitigating these vulnerabilities. Mission accomplished
๐ Bonus >> Try It Now
nc -u IP_ADDRESS 514
Have you encountered similarly flawed service implementations? How did you handle them? Share your experiences and strategies for maintaining system security in the comments ๐.
To Post
Post XX6
๐ Jump-start Your SOC Analyst Career - A Roadmap to Cybersecurity Success By Tyler Wall & Jarrett Rodrick
๐ Contents:
๐ The Demand for Cybersecurity and SOC Analysts
๐ฏ Areas of Expertise in Cybersecurity
๐ Job Hunting
๐ ๏ธ Prerequisite Skills
๐จโ๐ผ The SOC Analyst
โ๏ธ SOC in the Clouds
๐ค SOC Automation
๐ Real SOC Analyst Stories
#Cybersecurity #SOCAnalyst #CareerDevelopment #InfoSec #CyberCareer #SecuritySkills #CloudSecurity
To write
Post X2
How to write Notes at meeting - LinkedIn Carusel
https://www.youtube.com/watch?v=yxHPScN_ct4
Post X3
make a carouse from this
https://www.linkedin.com/feed/update/urn:li:activity:6898730632017784832/?updateEntityUrn=urn%3Ali%3Afs_updateV2%3A(urn%3Ali%3Aactivity%3A6898730632017784832%2CFEED_DETAIL%2CEMPTY%2CDEFAULT%2Cfalse)&originTrackingId=otXB9JP1R76Zv%2Fcf5QStAA%3D%3D
CYBERSECURITY POSTURE SELF ASSESSMENT
Post X14
Write about creating a security map - https://www.linkedin.com/posts/shimi-cohen-62a4222b_security-blueprint-activity-7012329996908163072-uPeM?utm_source=share&utm_medium=member_desktop