Security Operations & Monitoring Flashcards

What is the main role of a Security Operations Center (SOC)?

Answer: Monitor and respond to security threats

A Security Operations Center (SOC) is a centralized unit responsible for continuously monitoring an organization's information systems for security incidents. Its main role involves detecting, analyzing, and responding to cybersecurity threats and vulnerabilities in real-time. SOC analysts use various tools and processes to protect the organization's assets from cyberattacks.

What does a SIEM system do?

Answer: Collects and correlates security logs

A Security Information and Event Management (SIEM) system is a powerful tool designed to provide a holistic view of an organization's security posture. It aggregates log data from various sources across the IT infrastructure, such as servers, network devices, and applications. By correlating these logs, SIEM systems can detect patterns and anomalies that indicate potential security incidents, enabling faster detection and response.

What is the purpose of log correlation in security monitoring?

Answer: Detect coordinated security incidents

Log correlation involves analyzing and linking security events from multiple disparate sources to identify relationships and patterns that might not be apparent from individual logs. This process is crucial for detecting sophisticated, multi-stage attacks or coordinated security incidents that span across different systems or network segments. By connecting the dots, correlation helps uncover complex threats that might otherwise go unnoticed.

Which metric represents the average time taken to detect a security incident?

Answer: MTTD

MTTD stands for Mean Time To Detect, which is a key metric in cybersecurity operations. It measures the average duration from the moment a security incident occurs until it is successfully identified and recognized by the security team. A lower MTTD indicates a more efficient and effective detection capability, allowing organizations to respond to threats more quickly.

Why is continuous monitoring essential in cybersecurity?

Answer: To detect and respond to threats in real time

Continuous monitoring is fundamental in modern cybersecurity because threats are constantly evolving and occurring. It involves the ongoing surveillance of an organization's systems, networks, and data for suspicious activities or vulnerabilities. This real-time vigilance allows security teams to detect and respond to threats promptly, minimizing potential damage and maintaining a strong security posture.

What is alert fatigue in security operations?

Answer: Analysts ignore important alerts

Alert fatigue occurs when security analysts are overwhelmed by a high volume of security alerts, many of which may be false positives or low priority. This constant barrage can lead to desensitization, causing analysts to become less vigilant, miss critical warnings, or even ignore important alerts altogether. It significantly reduces the effectiveness of security monitoring and incident response.

What is the purpose of a security dashboard?

Answer: Visualize threats and metrics

A security dashboard provides a centralized, graphical interface that displays key security metrics, alerts, and threat intelligence in an easily digestible format. Its purpose is to give security teams and management a real-time overview of the organization's security posture. This visualization helps in quickly identifying trends, prioritizing threats, and making informed decisions regarding security operations.

What should be the response when a security event is detected?

Answer: Investigate and take action

When a security event is detected, the immediate and appropriate response is to investigate its nature and severity. This involves gathering more information, confirming if it's a true incident, and then taking decisive action based on the findings. Ignoring or delaying action can allow a potential threat to escalate and cause greater harm to the organization.

Which team handles alerts and threat mitigation in real-time?

Answer: Security Operations Center (SOC)

The Security Operations Center (SOC) is the dedicated team responsible for the continuous monitoring, detection, and analysis of security events. When alerts are triggered, the SOC team investigates them, determines their legitimacy, and then takes immediate action to mitigate identified threats in real-time. They are at the forefront of an organization's defense against cyberattacks.