Very Good: Not Good Enough

As a follow on to my previous post, I want to address the cancellation of SANS MGT517.

The short story is there will be no additional offering of this course via SANS, and that is a final decision. I will provide training in the Security Operations Center subject matter via some non-SANS vehicle, stay tuned for the exact details around this in 2019.

The class was cancelled because the scores (from the daily feedback forms) were not good enough for SANS. I'm not going to address the relative merit of that decision, but needless to say I'm disappointed. 

Nonetheless, I think the content I wrote for MGT517 is very valuable to the community, and most of the students who have taken the class have expressed their appreciation of the material, and how it has helped them.

That's all I have for now. Next update after the new year.

File under #Failure: MGT517 cancelled

Personal failure is always tough to acknowledge. MGT517 has been cancelled from any future runs. There are three remaining in 2018, and none scheduled in the future: https://www.sans.org/mgt517

Standby here for my analysis of this situation and what lead to it. I will also include some speculation on next steps. Expected time frame is mid-November.

2018 Security Operations SOC Summit wrap up

2018 SOC Summit is finished, the MGT517 following it is almost done. I'm enjoying co-teaching it with Carson Zimmerman. It's his first time out, and I've enjoyed hearing his perspectives on the material.

I'll hit the high points from the talks with my favorite take away from each. For the TL;DR, have a few memes from the talks.

You should download the talks from here:
https://cyber-defense.sans.org/resources/summit-archives

Carson:
. Measure not just the breadth of your log collection, but the depth
. Unit test your SIEM rules / use cases
. Track your SIEM use case analyst quality
. Analyst baseball card

Shelly & Brett
. Establish Trust and protect it
. Scribe to collect and report: but everyone is repsonsible for taking notes!

Alissa
. Insight into the state of your potential hires. Go read what they are saying about their prospects.
. Chaos is not for everyone
. Bad apples spread bacteria
. Let Alissa talk to your SOC analysts! Figure out the problems and address them.

SOC Survey
. Hard to collect data, and we don't have a defined data set, but here are the highlights for this year's survey.
. Tune in for the webcasts and download the paper.

CompariSIEM
. tools matter, but making the most of the tool is the path to success

FOOD, not FUD
. Framework of 5 items to provide Factual, Objective, Optimized Data

Sun or Stars
. Challenges are abundant, few organizations are thinking about striving for what's best for the long term

Hacking your SOEL:
. Move the activity to the front of the response activity

All about your Assets:
. Identify tools that contain the information you need, and figure out how to connect those tools together

The Healthy SOC: A Case Study:
. I'm going to ask you next year to come give a presentation about how you moved from where you are today to what you are next year. Will we be impressed? ;)


-=-=-=-=-=- ~Day 2~ -=-=-=-=-=-

What the CISO Really Wants
. Have an in person conversation once a month with no computers, no technology, where you listen to understand

Building the SecOps Use Case:
. Develop the program for building and assessing use cases, starting with business use

Back to Basics: System Integrity
. Integrity Monitoring is important for identifying change

TTP Zero:
. Normalize the data to constrained conecpts to effectively and consistenly deliver the message on security operations

Technical to Managerial positions:
. It's a different skillset, you probably can't be both

Threat Hunting Tour de Force
. Start with ad hoc techniques then migrate them into procedures

Burning Down the Haystack
. operational tasks should be operational, identify pain points and fix them

Most Dangerous Game:
. Assess if you have full coverage using ATT&CK

Metrics, metrics, everywhere and not a lot of thinking

Someone sent me a personal e-mail asking for guidance on metrics, so I thought I would replicate that here publicly.

Also, Carson Zimmerman will keynote at the SOC Summit in New Orleans in August, 2018 with a talk specifically on metrics. Hopefully you can make it to that event. If you can't make it, you can check out that talk afterward via video.

When starting out, I'd pick 3-5 reported metrics and a couple of service level objectives to start. Too many metrics results in diminished clarity on if you're meeting the objectives of the organization.

Metric

. Time to detection

. Method of Detection

. Time to initiate Response

.  Root cause analysis: Level 1,2,3. 

1 is a measure was available, but wasn't applied

2 is a measure was available, we chose through risk acceptance not to apply and it allowed issue to occur

3 is "zero day" - no measure was available

Service Level Objectives

. Initial notification within 1 hour to system owners of affected systems

. Eradication results in final closure, no need to reopen 100% of time

Online resource, look at Veris, which is the data schema behind the Verizon DBIR:

http://veriscommunity.net/incident-track.html

Look at Pescatore's "briefing the board" info:

https://www.sans.org/summit-archives/file/summit-archive-1496685631.pdf

https://www.sans.org/webcasts/influencing-effectively-communicating-ceos-boards-directors-103927

For a book to read on metrics, the standard reference is Joqaith's Security Metrics:

https://www.amazon.com/Security-Metrics-Replacing-Uncertainty-Doubt/dp/0321349989

Also look at the Hubbard / Siersen  "how to measure risk" book. Rich gave a talk last year at the SOC summit, but I don't see the talk posted. 

https://www.sans.org/summit-archives/cyber-defense