Markdown Editor
Ouvrir l'éditeur

Kit opérations de sécurité (SOC)

Normes et runbooks SOC : journalisation, politique de vulnérabilités et correctifs, secrets, règles de détection, chasse aux menaces, playbooks, réponse aux incidents, exercices, posture.

Étape 1

Politiques

  1. Security Logging Standard Template (OMB M-26-14, NIST AU)

    Complet

    Logging policy statements, required sources by tier, fields and UTC time sync, SIEM pipeline, integrity, searchable vs retrievable retention, privacy, coverage metrics, use cases

    Joint guide Best Practices for Event Logging and Threat Detection (2024); NIST SP 800-53 Rev. 5 AU; OMB M-26-14

  2. Vulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)

    Complet

    Enterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics

    CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4

  3. Patch Management Policy Template (NIST SP 800-40 Rev. 4)

    Complet

    Patch and update policy: scope, maintenance groups, routine, expedited and emergency cadences, testing rings, windows, rollback, end-of-life software, mitigations, exceptions, metrics

    NIST SP 800-40 Rev. 4; CISA BOD 26-04

  4. Secrets Management Standard Template (OWASP, NIST SP 800-57)

    Complet

    Secrets standard: classes, inventory, approved stores, issuance, rotation, workload identity, CI/CD and Kubernetes rules, scanning, leak response, break-glass

    OWASP Secrets Management Cheat Sheet; NIST SP 800-57 Pt 1 Rev. 5; SP 800-53 Rev. 5
Étape 2

Détection et chasse aux menaces

  1. Detection Rule Specification Template (Sigma, ATT&CK)

    Complet

    One detection as code: hypothesis, ATT&CK mapping, data fields, Sigma rule and correlation, thresholds, test cases, tuning, severity, playbook, lifecycle

    Sigma Specification v2.1.0; MITRE ATT&CK v20

  2. Threat Hunting Plan and Report Template (ATT&CK)

    Complet

    Plan and report for one hunt: trigger, hypothesis, ATT&CK techniques, data gaps, queries, robust baseline, findings, escalations, detections created, metrics

    MITRE ATT&CK v20; PEAK and TaHiTI (names only); NIST SP 800-61 Rev. 3

  3. SOC Playbook Template (NIST SP 800-61r3, ATT&CK, D3FEND)

    Complet

    One incident type: triggers, triage, severity, containment decisions, eradication, recovery, evidence, notification clocks, ATT&CK, D3FEND, CSF 2.0

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; MITRE ATT&CK v20; MITRE D3FEND 1.6.0
Étape 3

Gestion des incidents

  1. Incident Severity Matrix Template (SEV1 to SEV4)

    Complet

    Organisation SEV1 to SEV4 standard, impact criteria, response per level, security track, crisis flag, upgrade and downgrade rules, worked examples

    PagerDuty Incident Response docs; NIST SP 800-61 Rev. 3

  2. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    Complet

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  3. Incident Commander Handbook Template

    Complet

    IC and response roles, RACI, staffing by severity, declaring and taking command, battle rhythm, decision log, escalation, handover, closing, one-page IC checklist

    PagerDuty Incident Response docs; FEMA NIMS 3rd ed. (ICS)

  4. Incident Postmortem Template

    Complet

    Blameless incident postmortem: severity per matrix, impact and error budget, UTC timeline, root cause, 5 Whys, security incident links, action items

    Google SRE postmortem practice (concepts, 1st and 2nd ed.); NIST SP 800-61 Rev. 3
Étape 4

Répétitions et tests

  1. Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)

    Complet

    Discussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan

    CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84
Étape 5

Évaluations

  1. Cloud Security Posture Review Template (CSA CCM v4.1)

    Complet

    Periodic cloud posture review: scope, shared responsibility, CSPM findings by CCM v4.1 domain, identity, exposure, data, logging, drift, risks, actions, trend

    CSA CCM v4.1 (domains and IDs); CIS Benchmarks named

  2. NIST CSF 2.0 Organizational Profile Template

    Complet

    CSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary

    NIST CSF 2.0 (CSWP 29, 2024)

  3. Threat Model Template (STRIDE)

    Complet

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE

  4. Penetration Test Report Template (PTES, OWASP WSTG)

    Complet

    Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest

    PTES; OWASP Web Security Testing Guide