The image on the left is a SOC: the security operations center in big companies

These are more than good intentions. Notice: this definition does not include technical words. It talks first about people and processes, and then systems. It also talks about constant improvement and doing your best We will see during this session the many aspects of cybersec background: https://www.freeimageslive.co.uk/files/images011/beautiful_clouded_sky.jpg

This is an example of an incident, and we will take advantage of this video to learn about the different roles in cybersec On August 2021, some surveillance cameras in Iran’s Evin prison, in the capital Tehran, have apparently being hacked by a cyberactivist group. The videos show something very similar to an incident response event like the ones you are going to face in the near future. For this presentation, we are only interested in the events shown by the camera in the security office, minutes 0:00 to 1:30 in the linked video. Warning: there are disturbing images of violence after 1:30. - 0:12: This is a normal day in a security office center. Probably, this is going to be the entry job for many of you: monitoring systems ("SOC analysts level 1" is the technical term https://www.cybersecurity-professionals.com/jobs-1/SOC-Analyst-Tier-1 ). This is a surveillance room, but a cybsersecurity office is quite similar to this one: lots of screens showing details about your network and the actions that are happening in this moment. Notice: - For this room to work, someone has already put in place the systems: firewalls, authentication, permissions... This is another role: the security architect. The security architect sets up the systems, but doesn't run them. An architect is a very skilled person with some years of experience - 0:35: something is happening, but the analyst is not yet aware. - The screens cannot show all that is happening at this moment. Data must be filtered, only relevant events have to be shown... this is a very careful process of filtering and prioritizing data and showing alarms is made by the "SOC analyst tier 3" - 0:50: something happened and the analyst is finally aware. He is also aware whatever is happening, it is beyond his skills. As a result, he escalates to the "tier 2". - 1:08 The "tier 2" is a more trained / experimented team that acts when tier 1 is not enough and stat the manage the incident. In this case, they are assessing the communication. No actions are taken at this moment! These are only some roles: preparing systems, filtering out data, monitoring, responding to incidents... Even the attackers are another role that must be taken into consideration. Let's see these roles in more detail

These are the different roles in the cybersecurity field. Each one of the colors is a general domain, and each of the bubbles a specialist. You will probably develop your career moving from bubble to bubble, and occasionaly from domain to domain.

These are the main domains in cybersecurity: - Defense, avoiding the bad guys to enter the premises - Firefighters, fixing things when things go down - Reactive, or forensic analysists. They act after a security incident - Hacking, to find vulnerabilities, test the security of the system or learn about new things - Engineers, to develop the security systems - Management roles

There are several "sub-roles" inside the blue team: - Security Office Center tier 1: monitor systems and respond to common security events - SOC tier 2: respond to exceptional security events - SOC tier 3: configure alarms, filter data... - Threat intelligence: learn about current attacks and check if your company has the defenses against them - Define alarms and playbooks They are usually the security department of a company, in the IT department, and they work on-premises. Large companies are starting to outsource the monitoring of the security systems, and the SOC (i.e., "the monitoring") is run by an external entity. Skills: reading, detailed-oriented, kwowledge about a security product. No coding required!

Incident responders act when an intrusion is confirmed. You have seen this many times in movies: https://www.youtube.com/watch?v=msX4oAXpvUE They must identify: - which systems were affected. It is not an easy task. For example, during a ransomware, the entry point used by the attackers is probably NOT encrypted. - the attackers usually leave "persistence mechanisms" to be able to enter the company again after the incident - is there information leak apart from the ransomware? Notice: when an incident responder acts, the security systems already failed. Firewalls, antiviruses... they are of little use. The tools and skills they use are different. The Incident Response team is nearly always externalized, outsourced to a specialized company Skills: very good communication skills and cold blood

You have seem this many times in movies: https://www.youtube.com/watch?v=Vxq9yj2pVWk A forensic analysts: - investigates some special security events that the SOC cannot decide if there was an intrusion or not. For example, there is some logon attempts from the machine used by the company CEO and monitoring is not enough. The antivirus does not say something. Is is compromised? - Identify the identity of the bad guys. Can we prosecute them? Did they receive assistance from someone inside? - Act as Expert Witness in a trial Forensics analysts check very carefully a security event. Time is usually not important to them. Forensic analysts, specially if they must act as Expert Witness, are external to a company

most of the time, nothing happens. You need to have a good trained blue team, up to date with the last threats and vulnerabilities, and their procedures and tools must be checked regularly. You need false attacks to test the capabilities of your blue team. The reds act as a simulated attacker The goals, extends and tools are previously defined with the management! Do not run a red team exercise without consent! The terms of the red team exercises are negotiated. For example, whether or not they are allowed to have internal help The blue team is NOT aware that a red team was hired. They have to manage the incident as a real attack, if they are able to detect the attack Skills: hack-the-box, meterpreter, basic scripting...

background: https://bakerstuart.com/wp-content/uploads/2016/04/chagin.jpg

This is a typical organigram for the cybersecurity departments of a big company The CISO (Chief Information Security Officer) is the main responsible of the cybersec in an organization. It can report directly to the CEO (general manager of the company) or to the CIO (Chief Information Officer, he/she manages all other aspects of the information technologies) Check: https://blogs.cisco.com/security/should-the-ciso-report-to-the-cio Many companies cannot afford to have dedicated departments, and some of these are oursourced. For example, it is common outsourcing the Security Operations Center, the Incident Management and the Red Teams, specialy if cyber is not your core business.

You will be a specialist in one of these roles, but your day to day work probably involves different roles at different times. Also, while you develop your career, you are going to jump from one role to another.

Technical knowledge is only a part of the skill set!

1 out of every 4 detected 0-day exploits could potentially have been avoided if a more thorough investigation and patching effort were explored. Across the industry, incomplete patches — patches that don’t correctly and comprehensively fix the root cause of a vulnerability — allow attackers to use 0-days against users with less effort. > https://googleprojectzero.blogspot.com/2021/02/deja-vu-lnerability.html

Current cybersecurity is a complex and huge field. You are not expected to know every small detail about all systems or every possible technique, not only because the unfathomable amount of information but also because this knowledge will be outdated in months. Aiming to complete knowledge will be a source of stress and frustration. Please, check the links in the first session or search for "occupational burnout syndrome", "SOC analyst burnout", and "impostor syndrome". I truly believe that learning about these syndromes is going to be very useful for you or for the people you will lead in the future. On the contrary, you are expected to know about how to search information about current attacks, have high analytical skills, being able to prioritize the relevant leads among all the possible evidences and efficiently communicate your findings. You are most probably going to be specialized on a specific path (red, blue, incidents, forensics...), but the specialization will come naturally after some time in the field, probably years. You are not going to be alone. You are going to be part of a team that will teach and will mentor you. Gathering a security team inside a large company, or creating a small company to offer security services to some big companies, is very similar to gathering a group in a RPG game: you need a soldier, a magician, and a thief; i.e., you need someone specialized in blue, a forensic analyst and a red. Like in a RPG game, you begin as a low level character and you will gain knowledge and experience learning from other team members, earning some certification (1st session), playing CTFs (3rd session) or during real battles against the bad guys. You'll spend more time in the lab, writing reports or attending a brainstorming meeting than running commands. Check, for example, all comments in this thread in twitter: https://twitter.com/TinkerSec/status/1423864769271017476 There are lots of things to do in cybersecurity and these sessions are just presenting the huge oportunities to you.

The first reference is a SANS summit specialized in what to expect when you are starting a cybersecurity career. Check the playlist: many sessions on the matter! The second reference is a commercial book. It is usually on sale in Humble Bundle.