Markdown Editor
Abrir el editor

Kit de operaciones de seguridad (SOC)

Estándares y runbooks del SOC: registros, política de vulnerabilidades y parches, secretos, reglas de detección, búsqueda de amenazas, playbooks, respuesta a incidentes y simulacros.

Paso 1

Políticas

  1. Security Logging Standard Template (OMB M-26-14, NIST AU)

    Completa

    Logging policy statements, required sources by tier, fields and UTC time sync, SIEM pipeline, integrity, searchable vs retrievable retention, privacy, coverage metrics, use cases

    Joint guide Best Practices for Event Logging and Threat Detection (2024); NIST SP 800-53 Rev. 5 AU; OMB M-26-14

  2. Vulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)

    Completa

    Enterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics

    CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4

  3. Patch Management Policy Template (NIST SP 800-40 Rev. 4)

    Completa

    Patch and update policy: scope, maintenance groups, routine, expedited and emergency cadences, testing rings, windows, rollback, end-of-life software, mitigations, exceptions, metrics

    NIST SP 800-40 Rev. 4; CISA BOD 26-04

  4. Secrets Management Standard Template (OWASP, NIST SP 800-57)

    Completa

    Secrets standard: classes, inventory, approved stores, issuance, rotation, workload identity, CI/CD and Kubernetes rules, scanning, leak response, break-glass

    OWASP Secrets Management Cheat Sheet; NIST SP 800-57 Pt 1 Rev. 5; SP 800-53 Rev. 5
Paso 2

Detección y búsqueda de amenazas

  1. Detection Rule Specification Template (Sigma, ATT&CK)

    Completa

    One detection as code: hypothesis, ATT&CK mapping, data fields, Sigma rule and correlation, thresholds, test cases, tuning, severity, playbook, lifecycle

    Sigma Specification v2.1.0; MITRE ATT&CK v20

  2. Threat Hunting Plan and Report Template (ATT&CK)

    Completa

    Plan and report for one hunt: trigger, hypothesis, ATT&CK techniques, data gaps, queries, robust baseline, findings, escalations, detections created, metrics

    MITRE ATT&CK v20; PEAK and TaHiTI (names only); NIST SP 800-61 Rev. 3

  3. SOC Playbook Template (NIST SP 800-61r3, ATT&CK, D3FEND)

    Completa

    One incident type: triggers, triage, severity, containment decisions, eradication, recovery, evidence, notification clocks, ATT&CK, D3FEND, CSF 2.0

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; MITRE ATT&CK v20; MITRE D3FEND 1.6.0
Paso 3

Incidentes

  1. Incident Severity Matrix Template (SEV1 to SEV4)

    Completa

    Organisation SEV1 to SEV4 standard, impact criteria, response per level, security track, crisis flag, upgrade and downgrade rules, worked examples

    PagerDuty Incident Response docs; NIST SP 800-61 Rev. 3

  2. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    Completa

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  3. Incident Commander Handbook Template

    Completa

    IC and response roles, RACI, staffing by severity, declaring and taking command, battle rhythm, decision log, escalation, handover, closing, one-page IC checklist

    PagerDuty Incident Response docs; FEMA NIMS 3rd ed. (ICS)

  4. Incident Postmortem Template

    Completa

    Blameless incident postmortem: severity per matrix, impact and error budget, UTC timeline, root cause, 5 Whys, security incident links, action items

    Google SRE postmortem practice (concepts, 1st and 2nd ed.); NIST SP 800-61 Rev. 3
Paso 4

Ensayos y pruebas

  1. Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)

    Completa

    Discussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan

    CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84
Paso 5

Evaluaciones

  1. Cloud Security Posture Review Template (CSA CCM v4.1)

    Completa

    Periodic cloud posture review: scope, shared responsibility, CSPM findings by CCM v4.1 domain, identity, exposure, data, logging, drift, risks, actions, trend

    CSA CCM v4.1 (domains and IDs); CIS Benchmarks named

  2. NIST CSF 2.0 Organizational Profile Template

    Completa

    CSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary

    NIST CSF 2.0 (CSWP 29, 2024)

  3. Threat Model Template (STRIDE)

    Completa

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE

  4. Penetration Test Report Template (PTES, OWASP WSTG)

    Completa

    Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest

    PTES; OWASP Web Security Testing Guide