{"id":9438,"date":"2021-03-24T14:12:44","date_gmt":"2021-03-24T13:12:44","guid":{"rendered":"http:\/\/nfirjun2026.local\/siem-and-soc\/"},"modified":"2024-06-24T14:15:11","modified_gmt":"2024-06-24T12:15:11","slug":"siem-and-soc","status":"publish","type":"post","link":"https:\/\/www.cyber-security-online.nl\/en\/siem-and-soc\/","title":{"rendered":"SIEM and SOC"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Does your organization have an IT landscape whose security status you want to<\/a> map? Do you always want to be able to respond as adequately as possible to detected security alerts and threats? Then NFIR offers you a scalable, manageable and affordable solution with its Security Information and Event Management (SIEM) and Security Operation Centre (SOC) implementation. We offer our SIEM as a fully automated solution, where you no longer have to interpret data yourself. The output are reports on which your IT department can take action. Find out on this page how we completely unburden you and what results you will achieve when implementing our SIEM and SOC solution.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

In 5 steps to a resilient online environment<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Currently you already have several devices in your network that store information. Often the existing dashboards of firewalls, for example, are far too complicated to interpret or your employee does not have time for it. Therefore, have the security monitoring specialists of NFIR automatically process this log data on the basis of use cases that we jointly determine. In addition to rule-based processing of log information, NFIR also works with machine learning to detect patterns that may indicate suspicious traffic. By monitoring network activities in this way, you are quickly informed of suspicious activities and can take appropriate action. For a secure and orderly approach, we work with a step-by-step plan.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

1. Identify use cases. <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n

As a starting point of the <\/span>use<\/span>-case development we assume to curb the risk of information being compromised by criminals for monetary gain through extortion. Consider the growing phenomenon of ‘<\/span>ransomware<\/span>‘ as well as to the ex-filtration of classified information. Criminals bypass detection measures that indicate the building of such an attack. This requires an understanding of how to detect these constructive activities; these activities are captured in the cyber <\/span>security market<\/span> also linked to the ‘Cyber Security <\/span>Kill<\/span> Chain’. See below for a representation of the common steps involved in this chain that can be taken and result in a successful attack. <\/span>The steps in this ‘chain’ have been worked out as an attack scenario, however, it is also possible that other paths could be used leading to a variety of scenarios. The translation to <\/span>use-<\/span>cases <\/span>remains<\/span> therefore a constant development that NFIR focuses on based on the constant supply of knowledge from various experiences. <\/span> <\/span><\/p>\n<\/div>\n

As a starting point, a simplification is used with the following attack steps:<\/span> <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
    \n
  1. Discovery of environments, vulnerabilities<\/span><\/li>\n
  2. Attempts at <\/span>account abuse<\/span> and\/or modification of rights <\/span> <\/li>\n
  3. Installing\/configuring malware<\/span><\/li>\n
  4. Communication appropriate to attacks <\/span><\/li>\n
  5. Catch-<\/span>all<\/span>‘, for analysis<\/span> <\/span><\/li>\n<\/ol>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
    <\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    2. Design <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    \n

    In this step, we work out the connection of the log sources, based on a design. The log sources should be collected through the network in an integer manner. Secure configurations are therefore used when connecting.<\/span><\/p>\n<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
    <\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    3. Implementation <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    After the design is established, implementation is provided including entry testing and aggregation of <\/span>logging<\/span>. The result is a <\/span><\/div>\n
    \n

    working environment including generating insight based on the <\/span>use-<\/span>cases.<\/span> <\/p>\n<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
    <\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    4. Monitoring\/Delivery. <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    Monitoring and tuning the <\/span>use<\/span>-cases including reporting findings on a monthly basis for optimization. In this phase, the main focus is on optimizing the <\/span>use-<\/span>cases. <\/span> <\/span><\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
    <\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    5. Monthly service <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    \n

    After realization of the initial <\/span>use-<\/span>cases, a monthly report is provided based on the<\/span> based on the developments within your organization. <\/span>Various actions can follow from this report. <\/span>Think<\/span> For example<\/span> introducing new or adjusted logsources for further optimization or a further detailing of the use cases. <\/span>use-<\/span>cases. These activities are included based on the entered scope and prioritized in consultation with <\/span>u. <\/span>On the NFIR side, specialist expertise is included on a monthly basis. In addition, consultations are held on the prioritization and activities required by a <\/span>service manager<\/span>.<\/span><\/p>\n<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    What results are achieved with our SIEM\/SOC solution?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The end result includes:<\/span> <\/span><\/p>\n