MAINSAIL Group’s Post

Question for anyone out there either running or working in an IT security operations team: What kind of changes to the team personnel have you seen in the last 2 years? I am used to seeing a blend of security analysts and security engineers. Most of the tasks happening between those team members will include: -Developing/implementing security controls -Direct incident response -Vuln Mgmt/Attack Surface Mgmt -Running the security stack (email/endpoint/cloud) -Detection/SOAR development and log collection oversight Am I missing something in my world view that needs to be factored into a more future-proof team design, or even a change to the types of work I expect to be done within a SOC team?

The most valuable thing I have learned from working on both sides of security, the Operations side and the Security side, is to better translate what different people want. An Auditor may say, "You must keep all security relevant logs for seven years." A Splunk Admin may interpret that as, "I need to keep all logs for seven years." An Auditor may only be concerned with items which have been surfaced as part of an Incident Response investigation, and is outside of Splunk anyway. Getting in between to provide some translation and really help make sure that what is provided is what is expected and to avoid over engineering a solution.

Monitoring may seem like collecting logs, but there's a lot of value to it: * Ability to assist with difficult systems debugging. * Analysis of resource usage to check on if your key infrastructure has enough compute resources dedicated to it or if it has too much. This ties in with cost savings. * Can provide usage metrics to understand where to efforts on product features. * This can also help with showing the business value of a feature add to the company to validate its spend. * Security auditing to ensure that only the people that should be logging in are doing so. Especially important if you're in any sort of SOC-2/PCI/HIPAA type compliance. Live by monitoring.

Security operations teams should be structured into three tiers to focus on key outcomes: Triage (tier 1): The first line of response for security incidents. Triage is focused on the high-volume processing of alerts and is generated by automation and tools. The triage processes solve most common incident types and resolve them within the team. More complex incidents, or incidents that have not been seen and resolved before, should be escalated to tier 2. Investigation (tier 2): Focuses on incidents that require further investigation, often requiring a correlation of data points from multiple sources. This investigation aims to provide repeatable solutions to issues escalated to tier 2. It then enables tier 1 to resolve later recurrences of that issue type. Tier 2 will also respond to alerts against business-critical systems to reflect the severity of the risk and the need to act quickly. Hunt (tier 3): Focuses primarily on proactive hunting for highly sophisticated attack processes and developing guidance to the wider teams. The tier 3 team also acts as an escalation point for major incidents to support forensic analysis and response. #threatintelligence #cloudadoption

Check out the great opportunities listed below!

IBM’s most recent report detailed that it now takes on average 277 days for security teams to identify and contain a data breach - that breach life cycle continues to be a huge factor in the overall financial impact Businesses need to have an Incident Response Plan or Strategy - an expert team ready 24 x 7 to jump into action if the worst should happen to rapidly respond, contain and remediate. With Cybereason Incident Response Retainer, customers have the peace of mind that they have a team that can do this for them, please see below for more detail around what we can offer customers. https://lnkd.in/duqcztkD

The CrowdStrike outages are another reminder of how critical it is to demand rigor and excellence in your patch management process (In CrowdStrike's case) as well as the importance of your on-the-ground incident response team (In 70% of F100 companies' case) Most of the fixes/work arounds to critical systems affected by the outage had to be done hands-on with machines by on-the-ground teams. Let's hope there's not a next time, but in case there is IT Leaders should consider where their staff/consultants who can respond to incidents like this are physically located. If you are looking into how to find & select top-tier US-Based Security, Incident Response, Software, or Infrastructure staff let's discuss how Software Resources can partner with you. #IncidentResponse #PatchManagement #ITTalent #Staffing #Recruiting #LocalTalent

The best advice to become a smart contract developer or security researcher: "Show up" Everyday. And get 1% better than yesterday.

I've been there too! Early in my career, I accidentally updated a table. I've seen colleagues delete more data than intended because they missed a WHERE condition, and another who dropped a table in production. We've all got these stories, right? It's almost like a rite of passage. You mess up once, but you'll never do it again. Here are a few tips for all you SQL wizards: 💻 Automate your database changes: The tools these days are way better than 20 years ago, so there's no excuse to work directly on production. 🔐 Use Privileged Access escalation: Make sure production accounts have extra security steps to prevent accidents. 👥 Pair up for production changes: If you must make a change in a Production environment, like a hotfix or emergency update, always, always do it with another engineer. 📦 Backup before you act: Always have backups or take one before making changes in production. 🔄 Use Transactions for risky updates/deletes: This can save you from big headaches. ⏰ No Friday or end-of-day releases: Seriously, don't do it if you can avoid it.

Verizon's 2023 DBIR Report communicates that top attack patterns using System Intrusion, Social Engineering and Basic Web Application Attacks between SMBs and large corporations average around 89% of breaches (SMBs = 92% Large Corps = 85%). That being said, learning about these different attacks can help you reduce risk in your business. LetsDefend's "Detecting Web Attacks" course teaches five common web attacks: 1. SQL Injection (SQLi) 2. Command Injection 3. Cross-Site Scripting (XSS) 4. Insecure Direct Object Reference (IDOR) 5. Local File/Remote File Intrusion (LFI/RFI) What is the main takeaway? All of these attacks stem from a lack of input sanitization, that is any data taken from the user and passed to the server to retrieve information. Recommendations are to sanitize user input, but what does that really mean? Read more here: https://lnkd.in/eXyBYQ3y Implementation of secure coding techniques when in the "development" phase of the software development lifecycle (SDLC) is important! Some useful tips: 🔑 Use tried and true frameworks that have sanitization functions built-in. 🔑 During the maintenance phase of the SDLC, ensure these frameworks are updated 🔑 Test Test Test...Planned Unit, Static, Dynamic, and Penetration testing to ensure proper sanitization and system handling 🔑 Implement strong policies that enforce proper setup and maintenance of public-facing endpoints.