book

The Modern Security Operations Center: The People, Process, and Technology for Operating SOC Services

by Joseph Muniz, Aamir Lakhani, Omar Santos, Moses Frost

May 2021

Intermediate to advanced

752 pages

23h 46m

English

Addison-Wesley Professional

Read now

Unlock full access

VisionWho Should Read This Book?How This Book Is OrganizedBook Structure

Introducing the SOCFactors Leading to a Dysfunctional SOCCyberthreatsInvesting in SecurityThe Impact of a BreachEstablishing a BaselineFundamental Security CapabilitiesStandards, Guidelines, and FrameworksIndustry Threat ModelsVulnerabilities and RiskBusiness ChallengesIn-House vs. OutsourcingSOC ServicesSOC Maturity ModelsSOC Goals AssessmentSOC Capabilities AssessmentSOC Development MilestonesSummaryReferences
Mission Statement and Scope StatementDeveloping a SOCSOC ProceduresSecurity ToolsPlanning a SOCDesigning a SOC FacilityNetwork ConsiderationsDisaster RecoverySecurity ConsiderationsInternal Security ToolsGuidelines and Recommendations for Securing Your SOC NetworkSOC ToolsSummaryReferences
Fundamental SOC ServicesThe Three Pillars of Foundational SOC Support ServicesSOC Service AreasSOC Service Job GoalsService Maturity: If You Build It, They Will ComeSOC Service 1: Risk ManagementSOC Service 2: Vulnerability ManagementSOC Service 3: ComplianceSOC Service 4: Incident ManagementSOC Service 5: AnalysisSOC Service 6: Digital ForensicsSOC Service 7: Situational and Security AwarenessSOC Service 8: Research and DevelopmentSummaryReferences
Career vs. JobDeveloping Job RolesSOC Job RolesNICE Cybersecurity Workforce FrameworkRole TiersSOC Services and Associated Job RolesSoft SkillsSecurity Clearance RequirementsPre-InterviewingInterviewingOnboarding EmployeesManaging PeopleJob RetentionTrainingCertificationsCompany CultureSummaryReferences
Data in the SOCData-Focused AssessmentLogsSecurity Information and Event ManagementTroubleshooting SIEM LoggingAPIsBig DataMachine LearningSummaryReferences
Why Exceeding CompliancePoliciesLaunching a New PolicyPolicy EnforcementProceduresTabletop ExerciseStandards, Guidelines, and FrameworksAuditsAssessmentsPenetration TestIndustry ComplianceSummaryReferences
Threat Intelligence OverviewThreat Intelligence CategoriesThreat Intelligence ContextEvaluating Threat IntelligencePlanning a Threat Intelligence ProjectCollecting and Processing IntelligenceActionable IntelligenceFeedbackSummaryReferences
Security IncidentsIncident Response LifecyclePhase 1: PreparationPhase 2: Detection and AnalysisPhase 3: Containment, Eradication, and RecoveryDigital ForensicsPhase 4: Post-Incident ActivityIncident Response GuidelinesSummaryReferences
Vulnerability ManagementMeasuring VulnerabilitiesVulnerability TechnologyVulnerability Management ServiceVulnerability ResponseVulnerability Management Process SummarizedSummaryReferences
Introduction to Data OrchestrationSecurity Orchestration, Automation, and ResponseEndpoint Detection and ResponsePlaybooksAutomationDevOps ProgrammingDevOps ToolsBlueprinting with OsqueryNetwork ProgrammabilityCloud ProgrammabilitySummaryReferences
All Eyes on SD-WAN and SASEIT Services Provided by the SOCFuture of TrainingFull Automation with Machine LearningFuture of Your SOC: Bringing It All TogetherSummaryReferences