Security Operations Center
Building, Operating, and Maintaining your SOC
1st Edition
Published on 2. November 2015
448 pages
978-0-13-405203-8 (ISBN)
Description
Security Operations Center
Building, Operating, and Maintaining Your SOC
The complete, practical guide to planning, building, and operating an effective Security Operations Center (SOC)
Security Operations Center is the complete guide to building, operating, and managing Security Operations Centers in any environment. Drawing on experience with hundreds of customers ranging from Fortune 500 enterprises to large military organizations, three leading experts thoroughly review each SOC model, including virtual SOCs. You'll learn how to select the right strategic option for your organization, and then plan and execute the strategy you've chosen.
Security Operations Center walks you through every phase required to establish and run an effective SOC, including all significant people, process, and technology capabilities. The authors assess SOC technologies, strategy, infrastructure, governance, planning, implementation, and more. They take a holistic approach considering various commercial and open-source tools found in modern SOCs.
This best-practice guide is written for anybody interested in learning how to develop, manage, or improve a SOC. A background in network security, management, and operations will be helpful but is not required. It is also an indispensable resource for anyone preparing for the Cisco SCYBER exam.
? Review high-level issues, such as vulnerability and risk management, threat intelligence, digital investigation, and data collection/analysis
? Understand the technical components of a modern SOC
? Assess the current state of your SOC and identify areas of improvement
? Plan SOC strategy, mission, functions, and services
? Design and build out SOC infrastructure, from facilities and networks to systems, storage, and physical security
? Collect and successfully analyze security data
? Establish an effective vulnerability management practice
? Organize incident response teams and measure their performance
? Define an optimal governance and staffing model
? Develop a practical SOC handbook that people can actually use
? Prepare SOC to go live, with comprehensive transition plans
? React quickly and collaboratively to security incidents
? Implement best practice security operations, including continuous enhancement and improvement
Building, Operating, and Maintaining Your SOC
The complete, practical guide to planning, building, and operating an effective Security Operations Center (SOC)
Security Operations Center is the complete guide to building, operating, and managing Security Operations Centers in any environment. Drawing on experience with hundreds of customers ranging from Fortune 500 enterprises to large military organizations, three leading experts thoroughly review each SOC model, including virtual SOCs. You'll learn how to select the right strategic option for your organization, and then plan and execute the strategy you've chosen.
Security Operations Center walks you through every phase required to establish and run an effective SOC, including all significant people, process, and technology capabilities. The authors assess SOC technologies, strategy, infrastructure, governance, planning, implementation, and more. They take a holistic approach considering various commercial and open-source tools found in modern SOCs.
This best-practice guide is written for anybody interested in learning how to develop, manage, or improve a SOC. A background in network security, management, and operations will be helpful but is not required. It is also an indispensable resource for anyone preparing for the Cisco SCYBER exam.
? Review high-level issues, such as vulnerability and risk management, threat intelligence, digital investigation, and data collection/analysis
? Understand the technical components of a modern SOC
? Assess the current state of your SOC and identify areas of improvement
? Plan SOC strategy, mission, functions, and services
? Design and build out SOC infrastructure, from facilities and networks to systems, storage, and physical security
? Collect and successfully analyze security data
? Establish an effective vulnerability management practice
? Organize incident response teams and measure their performance
? Define an optimal governance and staffing model
? Develop a practical SOC handbook that people can actually use
? Prepare SOC to go live, with comprehensive transition plans
? React quickly and collaboratively to security incidents
? Implement best practice security operations, including continuous enhancement and improvement
All prices
More details
Edition
1. Auflage
Language
English
Place of publication
Indianapolis
United States
Publishing group
Pearson Education (US)
Target group
College/higher education
ISBN-13
978-0-13-405203-8 (9780134052038)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Classification
Other editions
Additional editions
Joseph Muniz | Gary McIntyre | Nadhem AlFardan
Security Operations Center: Building, Operating, and Maintaining your SOC
Building, Operating, and Maintaining your SOC
Book
11/2015
1st Edition
Cisco Press
€48.99
Shipment within 15-20 days
Persons
Joseph Muniz is a consultant at Cisco Systems and security researcher. Joseph started his career in software development and later managed networks as a contracted technical resource. Joseph moved into consulting and found a passion for security while meeting with a variety of customers. He has been involved with the design and implementation of multiple projects, ranging from Fortune 500 corporations to large federal networks. Joseph is the author of and contributor to several books and is a speaker for popular security conferences. Check out his blog, http://www.thesecurityblogger.com, which showcases the latest security events, research, and technologies.
Gary McIntyre is a seasoned information security professional focusing on the development and operation of large-scale information security programs. As an architect, manager, and consultant, he has worked with a wide range of public and private sector organizations around the world to design, build, and maintain small to large security operations teams. He currently holds a Masters degree from the University of Toronto and has also been a long-time (ISC)2 instructor.
Dr. Nadhem AlFardan has more than 15 years of experience in the area of information security and holds a Ph.D. in Information Security from Royal Holloway, University of London. Nadhem is a senior security solution architect working for Cisco Systems. Before joining Cisco, he worked for Schlumbeger and HSBC. Nadhem is CISSP certified and is an ISO 27001 lead auditor. He is also CCIE Security certified. In his Ph.D. research, Nadhem published a number of papers in prestige conferences, such as IEEE S&P and USENIX Security, mainly around cryptoanalysis topics. His work involved him working with organizations such as Google, Microsoft, Cisco, Mozilla, OpenSSL, and many others, mainly to help them assess and fix major findings in the Transport Layer Security/Secure Sockets Layer (TLS/SSL) protocol. His work is referenced in a number of IETF standards.
Gary McIntyre is a seasoned information security professional focusing on the development and operation of large-scale information security programs. As an architect, manager, and consultant, he has worked with a wide range of public and private sector organizations around the world to design, build, and maintain small to large security operations teams. He currently holds a Masters degree from the University of Toronto and has also been a long-time (ISC)2 instructor.
Dr. Nadhem AlFardan has more than 15 years of experience in the area of information security and holds a Ph.D. in Information Security from Royal Holloway, University of London. Nadhem is a senior security solution architect working for Cisco Systems. Before joining Cisco, he worked for Schlumbeger and HSBC. Nadhem is CISSP certified and is an ISO 27001 lead auditor. He is also CCIE Security certified. In his Ph.D. research, Nadhem published a number of papers in prestige conferences, such as IEEE S&P and USENIX Security, mainly around cryptoanalysis topics. His work involved him working with organizations such as Google, Microsoft, Cisco, Mozilla, OpenSSL, and many others, mainly to help them assess and fix major findings in the Transport Layer Security/Secure Sockets Layer (TLS/SSL) protocol. His work is referenced in a number of IETF standards.
Content
Chapter 1 Introduction to Security Operations and the SOC
Chapter 2 Overview of SOC Technologies
Chapter 3 Assessing Security Operations Capabilities
Chapter 4 SOC Strategy
Chapter 5 The SOC Infrastructure
Chapter 6 Security Event Generation and Collection
Chapter 7 Vulnerability Management
Chapter 8 People and Processes
Chapter 9 The Technology
Chapter 10 Preparing to Operate
Chapter 11 Reacting to Events and Incidents
Chapter 12 Maintain, Review, and Improve
Chapter 2 Overview of SOC Technologies
Chapter 3 Assessing Security Operations Capabilities
Chapter 4 SOC Strategy
Chapter 5 The SOC Infrastructure
Chapter 6 Security Event Generation and Collection
Chapter 7 Vulnerability Management
Chapter 8 People and Processes
Chapter 9 The Technology
Chapter 10 Preparing to Operate
Chapter 11 Reacting to Events and Incidents
Chapter 12 Maintain, Review, and Improve
