Week 4 Flashcards
Security Operations Maturity Model (SOMM)
A means of measuring the effectiveness of your security operations program and of maturing its capabilities, thus improving your resilience to cyber threats.
Mean Time To Respond (MTTR)
The average time it takes to respond and ultimately resolve an incident that is detected.
Investigate,
Neutralize,
Recover;
Mean Time To Detect (MTTD)
The average time it takes to recognize the presence of a threat that requires further analysis and response efforts.
Collect,
Discover,
Qualify;
MTTD and MTTR Sub-categories
- Time to Qualify (TTQ)
- Time to Investigate (TTI)
- Time to Triage (TTT)
- Time to Detect (TTD)
- Time to Respond (TTR)
Threat Lifecycle Management (TLM)
Refers to the recommended workflow on the LogRhythm platform for minimizing SOC’s MTTD and MTTR. The TLM workflow is organized around the following six different stages of detection and response:
- Collect
- Discover
- Qualify
- Investigate
- Neutralize (referred to as Mitigation)
- Recover
Security Event and Alarm Data
Most organizations have an array of security products to prevent a wide range of attacks from being successful. However, in some cases, these technologies can only warn that an attack may be in process or has already occurred. In these cases, __________________ are generated.
Log and Machine Data
Can provide deeper visibility into an IT environment — recording on a per user, per system, per application basis — who did what, when, and where. This rich set of data can support more effective and rapid investigations of suspected attacks. The ability to comprehend what is normal within the IT environment is also within this dataset — enabling automated machine analytics to detect behavioural anomalies that might indicate a more advanced attack is in progress.
Forensic Sensor Data
Can provide even deeper and broader visibility. F
Can fill visibility gaps when logs aren’t available or where the level of forensic detail is insufficient.
There are two primary types of forensic sensors that might be employed:
- Network forensic sensors that capture packets and flows.
- Endpoint forensic sensors that can record with high fidelity all activity occurring on the monitored system.
Discover
Once organizations establish visibility, they now stand a chance at detecting and responding to threats.
________ of potential threats is accomplished through a blend of search and machine analytics.
Search Analytics
This type of a________ is performed by people and enabled by software. It includes things such as targeted hunting of threats by monitoring dashboards and leveraging search capabilities. It also includes reviewing reports to identify known exceptions. Search _________s is people-intensive. Thus, while effective, it cannot be the sole (or even primary) method of _________ most organizations should employ.
Machine Analytics
This type of analytics is performed by software using machine learning (ML) and other automated analysis techniques where outputs can be efficiently leveraged by people.
It is the future of a modern and efficient threat discovery capability. The goal of using machine analytics should be to help organizations realize a “risk-based monitoring” strategy through the automatic identification and prioritization of attacks and threats.
This is critical for both detecting advanced threats via data science-driven approaches, as well as helping organizations orient precious human cognitive cycles to the areas of highest risk to the business.
Qualify
Threats must be rapidly qualified to assess the potential impact on the business and the urgency of additional investigation and response efforts.
The qualification process is manual and time-intensive, while also being very time-sensitive.
An inefficient qualification process increases the level of human investment needed to evaluate all threat indicators (e.g., alarms), but an efficient process allows organizations to analyze more indicators with less staff.
Investigate
Once threats have been qualified, they need to be fully i_________ to conclusively determine whether a security incident has occurred or is in progress.
This begins with conducting a deep __________ using all the collected evidence to understand the risk presented by the threat and its scope.
Rapid access to forensic data and intelligence on the threat is paramount. Automation of routine investigatory tasks and tools that facilitate cross-organizational collaboration is ideal for optimally reducing MTTR.
Ideally, a secure facility for keeping track of all active and past investigations is available. This can help ensure that forensic evidence is well-organized and available to collaborators.
It can also provide an account of who did what in support of investigation and response activities to measure organizational effectiveness and hold parties responsible for the tasks they own in the investigation.
Neutralize
When an incident is qualified, organizations must implement mitigations to reduce and eventually eliminate risk to the business.
For some threats, such as ransomware or compromised privileged users, every second counts.
To maximally reduce MTTR, easily accessible and updated incident response processes and playbooks, coupled with automation, are critically important.
Similar to the Investigate stage, facilities that enable cross-organizational (e.g., IT, legal, HR) information sharing and collaboration are also important.
Recover
Once the incident has been neutralized and the risk to the business is under control, full recovery efforts can commence. These efforts are less time-critical, and they can take days or weeks depending on the scope of the incident.
To recover effectively and on a timely basis, it is imperative that an organization’s security team has access to all forensic information surrounding the investigation and incident response process.
This includes ensuring that any changes made during incident response are tracked, audit trail information is captured, and the affected systems are updated and brought back online. Many recovery-related processes can benefit from automation.
In addition, the recovery process should ideally include putting measures in place that leverage the gathered threat intelligence to detect if the threat returns or left behind a back door.
