Markdown Editor
Відкрити редактор

Набір операцій безпеки (SOC)

Стандарти та ранбуки SOC: логування, політика вразливостей і патчів, секрети, правила виявлення, пошук загроз, плейбуки, реагування на інциденти, штабні навчання й огляди стану захисту.

Крок 1

Політики

  1. Security Logging Standard Template (OMB M-26-14, NIST AU)

    Повний

    Logging policy statements, required sources by tier, fields and UTC time sync, SIEM pipeline, integrity, searchable vs retrievable retention, privacy, coverage metrics, use cases

    Joint guide Best Practices for Event Logging and Threat Detection (2024); NIST SP 800-53 Rev. 5 AU; OMB M-26-14

  2. Vulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)

    Повний

    Enterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics

    CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4

  3. Patch Management Policy Template (NIST SP 800-40 Rev. 4)

    Повний

    Patch and update policy: scope, maintenance groups, routine, expedited and emergency cadences, testing rings, windows, rollback, end-of-life software, mitigations, exceptions, metrics

    NIST SP 800-40 Rev. 4; CISA BOD 26-04

  4. Secrets Management Standard Template (OWASP, NIST SP 800-57)

    Повний

    Secrets standard: classes, inventory, approved stores, issuance, rotation, workload identity, CI/CD and Kubernetes rules, scanning, leak response, break-glass

    OWASP Secrets Management Cheat Sheet; NIST SP 800-57 Pt 1 Rev. 5; SP 800-53 Rev. 5
Крок 2

Виявлення та пошук загроз

  1. Detection Rule Specification Template (Sigma, ATT&CK)

    Повний

    One detection as code: hypothesis, ATT&CK mapping, data fields, Sigma rule and correlation, thresholds, test cases, tuning, severity, playbook, lifecycle

    Sigma Specification v2.1.0; MITRE ATT&CK v20

  2. Threat Hunting Plan and Report Template (ATT&CK)

    Повний

    Plan and report for one hunt: trigger, hypothesis, ATT&CK techniques, data gaps, queries, robust baseline, findings, escalations, detections created, metrics

    MITRE ATT&CK v20; PEAK and TaHiTI (names only); NIST SP 800-61 Rev. 3

  3. SOC Playbook Template (NIST SP 800-61r3, ATT&CK, D3FEND)

    Повний

    One incident type: triggers, triage, severity, containment decisions, eradication, recovery, evidence, notification clocks, ATT&CK, D3FEND, CSF 2.0

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; MITRE ATT&CK v20; MITRE D3FEND 1.6.0
Крок 3

Інциденти

  1. Incident Severity Matrix Template (SEV1 to SEV4)

    Повний

    Organisation SEV1 to SEV4 standard, impact criteria, response per level, security track, crisis flag, upgrade and downgrade rules, worked examples

    PagerDuty Incident Response docs; NIST SP 800-61 Rev. 3

  2. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    Повний

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  3. Incident Commander Handbook Template

    Повний

    IC and response roles, RACI, staffing by severity, declaring and taking command, battle rhythm, decision log, escalation, handover, closing, one-page IC checklist

    PagerDuty Incident Response docs; FEMA NIMS 3rd ed. (ICS)

  4. Incident Postmortem Template

    Повний

    Blameless incident postmortem: severity per matrix, impact and error budget, UTC timeline, root cause, 5 Whys, security incident links, action items

    Google SRE postmortem practice (concepts, 1st and 2nd ed.); NIST SP 800-61 Rev. 3
Крок 4

Репетиції та тестування

  1. Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)

    Повний

    Discussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan

    CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84
Крок 5

Оцінки

  1. Cloud Security Posture Review Template (CSA CCM v4.1)

    Повний

    Periodic cloud posture review: scope, shared responsibility, CSPM findings by CCM v4.1 domain, identity, exposure, data, logging, drift, risks, actions, trend

    CSA CCM v4.1 (domains and IDs); CIS Benchmarks named

  2. NIST CSF 2.0 Organizational Profile Template

    Повний

    CSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary

    NIST CSF 2.0 (CSWP 29, 2024)

  3. Threat Model Template (STRIDE)

    Повний

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE

  4. Penetration Test Report Template (PTES, OWASP WSTG)

    Повний

    Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest

    PTES; OWASP Web Security Testing Guide