Markdown Editor
Mở trình soạn thảo

Bộ mẫu vận hành bảo mật (SOC)

Chuẩn và runbook cho SOC: ghi log, chính sách lỗ hổng và vá lỗi, secret, quy tắc phát hiện, săn tìm mối đe dọa, playbook, ứng phó sự cố, diễn tập tabletop và đánh giá tư thế bảo mật.

Bước 1

Chính sách

  1. Security Logging Standard Template (OMB M-26-14, NIST AU)

    Đầy đủ

    Logging policy statements, required sources by tier, fields and UTC time sync, SIEM pipeline, integrity, searchable vs retrievable retention, privacy, coverage metrics, use cases

    Joint guide Best Practices for Event Logging and Threat Detection (2024); NIST SP 800-53 Rev. 5 AU; OMB M-26-14

  2. Vulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)

    Đầy đủ

    Enterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics

    CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4

  3. Patch Management Policy Template (NIST SP 800-40 Rev. 4)

    Đầy đủ

    Patch and update policy: scope, maintenance groups, routine, expedited and emergency cadences, testing rings, windows, rollback, end-of-life software, mitigations, exceptions, metrics

    NIST SP 800-40 Rev. 4; CISA BOD 26-04

  4. Secrets Management Standard Template (OWASP, NIST SP 800-57)

    Đầy đủ

    Secrets standard: classes, inventory, approved stores, issuance, rotation, workload identity, CI/CD and Kubernetes rules, scanning, leak response, break-glass

    OWASP Secrets Management Cheat Sheet; NIST SP 800-57 Pt 1 Rev. 5; SP 800-53 Rev. 5
Bước 2

Phát hiện và săn tìm mối đe dọa

  1. Detection Rule Specification Template (Sigma, ATT&CK)

    Đầy đủ

    One detection as code: hypothesis, ATT&CK mapping, data fields, Sigma rule and correlation, thresholds, test cases, tuning, severity, playbook, lifecycle

    Sigma Specification v2.1.0; MITRE ATT&CK v20

  2. Threat Hunting Plan and Report Template (ATT&CK)

    Đầy đủ

    Plan and report for one hunt: trigger, hypothesis, ATT&CK techniques, data gaps, queries, robust baseline, findings, escalations, detections created, metrics

    MITRE ATT&CK v20; PEAK and TaHiTI (names only); NIST SP 800-61 Rev. 3

  3. SOC Playbook Template (NIST SP 800-61r3, ATT&CK, D3FEND)

    Đầy đủ

    One incident type: triggers, triage, severity, containment decisions, eradication, recovery, evidence, notification clocks, ATT&CK, D3FEND, CSF 2.0

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; MITRE ATT&CK v20; MITRE D3FEND 1.6.0
Bước 3

Sự cố

  1. Incident Severity Matrix Template (SEV1 to SEV4)

    Đầy đủ

    Organisation SEV1 to SEV4 standard, impact criteria, response per level, security track, crisis flag, upgrade and downgrade rules, worked examples

    PagerDuty Incident Response docs; NIST SP 800-61 Rev. 3

  2. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    Đầy đủ

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  3. Incident Commander Handbook Template

    Đầy đủ

    IC and response roles, RACI, staffing by severity, declaring and taking command, battle rhythm, decision log, escalation, handover, closing, one-page IC checklist

    PagerDuty Incident Response docs; FEMA NIMS 3rd ed. (ICS)

  4. Incident Postmortem Template

    Đầy đủ

    Blameless incident postmortem: severity per matrix, impact and error budget, UTC timeline, root cause, 5 Whys, security incident links, action items

    Google SRE postmortem practice (concepts, 1st and 2nd ed.); NIST SP 800-61 Rev. 3
Bước 4

Diễn tập và kiểm thử

  1. Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)

    Đầy đủ

    Discussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan

    CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84
Bước 5

Đánh giá tác động

  1. Cloud Security Posture Review Template (CSA CCM v4.1)

    Đầy đủ

    Periodic cloud posture review: scope, shared responsibility, CSPM findings by CCM v4.1 domain, identity, exposure, data, logging, drift, risks, actions, trend

    CSA CCM v4.1 (domains and IDs); CIS Benchmarks named

  2. NIST CSF 2.0 Organizational Profile Template

    Đầy đủ

    CSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary

    NIST CSF 2.0 (CSWP 29, 2024)

  3. Threat Model Template (STRIDE)

    Đầy đủ

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE

  4. Penetration Test Report Template (PTES, OWASP WSTG)

    Đầy đủ

    Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest

    PTES; OWASP Web Security Testing Guide