Markdown Editor
Editor öffnen

Kit Security Operations (SOC)

SOC-Standards und Runbooks: Logging, Schwachstellen- und Patch-Richtlinie, Secrets, Erkennungsregeln, Threat Hunts, Playbooks, Incident Response, Tabletop-Übungen und Posture-Reviews.

Schritt 1

Richtlinien und Regeln

  1. Security Logging Standard Template (OMB M-26-14, NIST AU)

    Vollständig

    Logging policy statements, required sources by tier, fields and UTC time sync, SIEM pipeline, integrity, searchable vs retrievable retention, privacy, coverage metrics, use cases

    Joint guide Best Practices for Event Logging and Threat Detection (2024); NIST SP 800-53 Rev. 5 AU; OMB M-26-14

  2. Vulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)

    Vollständig

    Enterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics

    CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4

  3. Patch Management Policy Template (NIST SP 800-40 Rev. 4)

    Vollständig

    Patch and update policy: scope, maintenance groups, routine, expedited and emergency cadences, testing rings, windows, rollback, end-of-life software, mitigations, exceptions, metrics

    NIST SP 800-40 Rev. 4; CISA BOD 26-04

  4. Secrets Management Standard Template (OWASP, NIST SP 800-57)

    Vollständig

    Secrets standard: classes, inventory, approved stores, issuance, rotation, workload identity, CI/CD and Kubernetes rules, scanning, leak response, break-glass

    OWASP Secrets Management Cheat Sheet; NIST SP 800-57 Pt 1 Rev. 5; SP 800-53 Rev. 5
Schritt 2

Erkennung und Threat Hunting

  1. Detection Rule Specification Template (Sigma, ATT&CK)

    Vollständig

    One detection as code: hypothesis, ATT&CK mapping, data fields, Sigma rule and correlation, thresholds, test cases, tuning, severity, playbook, lifecycle

    Sigma Specification v2.1.0; MITRE ATT&CK v20

  2. Threat Hunting Plan and Report Template (ATT&CK)

    Vollständig

    Plan and report for one hunt: trigger, hypothesis, ATT&CK techniques, data gaps, queries, robust baseline, findings, escalations, detections created, metrics

    MITRE ATT&CK v20; PEAK and TaHiTI (names only); NIST SP 800-61 Rev. 3

  3. SOC Playbook Template (NIST SP 800-61r3, ATT&CK, D3FEND)

    Vollständig

    One incident type: triggers, triage, severity, containment decisions, eradication, recovery, evidence, notification clocks, ATT&CK, D3FEND, CSF 2.0

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; MITRE ATT&CK v20; MITRE D3FEND 1.6.0
Schritt 3

Vorfälle

  1. Incident Severity Matrix Template (SEV1 to SEV4)

    Vollständig

    Organisation SEV1 to SEV4 standard, impact criteria, response per level, security track, crisis flag, upgrade and downgrade rules, worked examples

    PagerDuty Incident Response docs; NIST SP 800-61 Rev. 3

  2. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    Vollständig

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  3. Incident Commander Handbook Template

    Vollständig

    IC and response roles, RACI, staffing by severity, declaring and taking command, battle rhythm, decision log, escalation, handover, closing, one-page IC checklist

    PagerDuty Incident Response docs; FEMA NIMS 3rd ed. (ICS)

  4. Incident Postmortem Template

    Vollständig

    Blameless incident postmortem: severity per matrix, impact and error budget, UTC timeline, root cause, 5 Whys, security incident links, action items

    Google SRE postmortem practice (concepts, 1st and 2nd ed.); NIST SP 800-61 Rev. 3
Schritt 4

Generalprobe und Test

  1. Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)

    Vollständig

    Discussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan

    CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84
Schritt 5

Bewertungen

  1. Cloud Security Posture Review Template (CSA CCM v4.1)

    Vollständig

    Periodic cloud posture review: scope, shared responsibility, CSPM findings by CCM v4.1 domain, identity, exposure, data, logging, drift, risks, actions, trend

    CSA CCM v4.1 (domains and IDs); CIS Benchmarks named

  2. NIST CSF 2.0 Organizational Profile Template

    Vollständig

    CSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary

    NIST CSF 2.0 (CSWP 29, 2024)

  3. Threat Model Template (STRIDE)

    Vollständig

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE

  4. Penetration Test Report Template (PTES, OWASP WSTG)

    Vollständig

    Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest

    PTES; OWASP Web Security Testing Guide