Cyber DefenceLesson 16Free preview
CS Security Operations
This lesson is part of Cyber Security · All levels
Summary
The Security Operations Center (SOC) functions to continuously monitor, detect, and respond to security incidents. Its main tool is SIEM which collects and correlates log from various sources to mark anomalies. Good security operations depend on quality, positive handling, and the application of the principle of least privilege.
Key points
- SOC operates 24/7 monitoring the infrastructure and handling security alerts.
- SIEM collects and correlates log for correlation-based detection.
- Positive: a false alarm about normal activity that needs to be reduced by tuning.
- Good management provides a trail for detection and investigation.
- Minimum privilege limits the impact when an account or process is compromised.
Full lesson
Code examples and quizzes
Full lessons, code examples, and quizzes are available to subscribers. 5 questions.