DEV Community: Muhammad Ahad Abbasi

SIEM VS SOC & HOW SIEM WORKS!!

Muhammad Ahad Abbasi — Fri, 09 Sep 2022 16:13:26 +0000

what is SIEM:

Security information and event management provide real-time analysis of security alerts generated by applications and network equipment.
In this blog we will use the term SIEM and Threat Hunting Tools interchangeably.
SIEM tools basically only provide hints or indicators that there might be a threat on the system or somewhere on the network. Then after that, some people like security analysts have to monitor the processes, mitigate this threat and document the case as part of the business process.

Therefore, it is important to note that the human brain is required to analyze and track a security case, since a SIEM tool cannot be implemented without a security control center or the SOC. It can be one person, it can be 20 people or more, depending on the requirements and size of the corporate network.

In other words, a company cannot implement SIEM and expect the tool to do all the security work for them.

This may lead to the question, what is a SOC?

Abbreviated as SOC (Security Operations Center), SOC is a collaborative work of security analysts, team tools, and processes to achieve the common goal of monitoring, discovering, and investigating the entire network and endpoints of a company in order to reduce the attack surface by detecting potential risks and threats. and proactively respond to them before they reach their endpoint or company network goals.

Why do we need a SOC (Security Operations Center)?

This is more of a business question than a technical one. Never try to justify an SOC claim in terms of the technical benefits it brings when we offer a business-required solution. The cost of an SOC should be justified to senior executives and management in terms of its impact on the business, not the technical performance and wonders it can create.

The most typical reason is the compliance auditing, which periodically happens for many respective companies that mostly external auditors are contracted to check and audit the overall security aspects of the company. If the compliance auditing produces negative results, it directly affects negatively the contracts that the company holds with its customers, and as a result, customers lose trust. So, in the end it will be a loss for the company.
Another reason is that the company decided to voluntarily increase its security awareness by monitoring the integrity of its security measurements to avoid threats and attacks surface across on the company's network.

Having said that, this leads to the question of what should be monitored by the SOC (Security Operations Center).

Again, this question cannot be answered at a technical round table.
From management to other relevant stakeholders, the company should also be involved in the decision-making process to determine which business processes, which applications, which critical endpoints, and which data should be monitored. where the log files will be stored and for how long. Who will have access to these log files and questions are sought after these sorts of business decisions have been made.

It is time to talk to techies like the IT department and check what kind of log data are being already collected from security applications or appliances in the company, and then check what lightweight data is missing for SOC purposes. So, cover them with SIEM as well.

Despite covering only critical and important log sources, the log data will slot from different sources like Firewalls, Ids, End points, Active Directory is probably some important IOT’s and so on, so it's going to be huge. Therefore, it will call for pre decisions to be made. How to handle that data lake.

For now, it is important to note that there are three points required to be well planned to run a successful thread hunting tool.
1) First Lots of Log Data.
In other words, no lots of logs, no working threat hunting tool

2) Second, Well Trained Security Analysts.
These are people who are trained as a security analyst and are familiar with the environment of the company and the context of those log files that are being generated every day. This is very crucial.

3) Third, Cyber Threat Intelligence
Threat intelligence is data that is collected processed and analyzed to understand a threat, actors, motives, targets and attack behaviors.

All these points are required for a threat hunting tool to be a useful and functional and purposeful feeling, all these three points are required for a threat hunting tool to be successful, but do not rely on threat hunting tool to do your job because well-trained analysts are needed. So, for this lecture/blog whatever you call it, it is important to understand that SIEM is just a tool and SOC is consisted of SIEM and other tools, plus analysts, people and procedures to detect, hunt and respond to the unknown.

How SIEM Works

This is how a company's network looks like in terms of assets.

They have different servers, storage storages. We should process or store large amount of data.
Then we have endpoints or clients such as Windows or Linux clients, along with IOT like cameras and so on, operational or industrial computers, all that constitute a company's assets. All of them are connected via switches and routers. And finally, there are some security apparatus such as firewalls and IPS IDS, which stands for intrusion prevention system and intrusion detection system, which observe the traffic and decide what can go through the company's network and what is not allowed.

This leads to the question.
There are already security tools there where the SIEM sits in the company's network SIEM tool is not a preventive security tool like firewall, anti-malware or IPS.
What it does is collecting every possible log data from different sources that we connect them to the SIEM system from servers and network devices to applications and databases, and it is towards them in a database. Great portion of the data collected from firewalls, IDS, network devices and so on are in this Syslog because almost all these appliances can speak Syslog, which is a standard protocol for message logging, for operating systems and point and servers such as Active Directory or Linux servers.
We can install an agent which normally comes with the SIEM tool company itself or its community, the same agent, and will collect and send the relevant security log data to the central log server of the SIEM.

As I mentioned, all these events and logs are coming in different log format. One of the same log manager duties is to consolidate and unify these logs, so-called log normalization and install them all unified in a same database.
The reason for this normalization is that later search and log analysis through the huge SIEM database will be much more reliable, performance optimized and quick to process, when log data are collected, normalized and analyzed, there are two possibilities creating a dashboard, using a small widget that many of the SIEM tools, including ELK stack offer. You will see this dashboard later.
Second possibility is creating rule rules or rule-set or a small pieces of query code, each of which resembles a pattern for a security use case we are interested in, and when that security use case happens anywhere in the company's network or any of the endpoints, we will get alarmed. Again, you will see these in action later on in this blog. For now, it is just an introduction. We just keep it theory to build up some fundamentals and then later on you will see them all in action.

After the alarms are triggered. And it is a SOC’s part to investigate the alarms. If they are really an attack incident or a security case or just a false positive.

One outcome of all this process can be Audit Compliance. Many well-structured companies are being audited by auditing companies, most of these auditing companies are external companies who just do auditing, who check if the company comply with the latest security standards or not. If a company does not pass its auditing process, it can have directly a negative effect on its business.
It's as simple as that.
The other outcome is I.T. security. Every company would like to stay safe and sound from cyber-attacks here does SIEM at least can help the security team of the company to have a better view on its network in terms of user behaviors and vulnerabilities, in different systems.

So, in general, this was how SIEM works.

we will discuss SIEM Use Cases and Common Mistakes in the next blog or I will just update this one instead.

Thanks for reading. See in the next blog.

Computer Security & Best Practices

Muhammad Ahad Abbasi — Mon, 15 Aug 2022 16:26:18 +0000

Title: Computer Security

The Internet has changed our lives in many ways. Unfortunately, this vast network and related technologies have also led to an increase in security threats. The most effective way to protect yourself from these threats and attacks is to know standard cybersecurity practices.

Computer security is the most important branch of computer science and plays a critical role in protecting information stored on a computer from security threats and hackers by providing easy access to information for authorized users. Security refers to ensuring that a computer system such as the processor, memory, software, and data stored on the system is securely protected. A computer compromised by unauthorized users can compromise organizations' confidential data. It is very important to protect your system from malware, unauthorized users, worms, viruses, and Trojans by taking the right security measures.

What is Computer Security?

Computer security is basically the protection of computer systems and information from harm, theft and unauthorized use. It is the process of preventing and detecting unauthorized use of your computer system.

There are various types of computer security that are widely used to protect an organization's valuable information.

What is Computer Security and Its Types?

One way to figure out the similarities and differences between computer securities is to ask what exactly is being protected. For example,
• Information security is securing information from unauthorized access, modification & deletion
• Application Security is securing an application by building security features to prevent from Cyber Threats such as SQL injection, DoS attacks, data breaches and etc.
• Computer Security means securing a standalone machine by keeping it updated and patched
• Network Security is by securing both the software and hardware technologies
• Cybersecurity is defined as protecting computer systems, which communicate over the computer networks

It is important to understand the difference between these words, although there is not necessarily a clear consensus on the meanings and the extent to which they overlap or are interchangeable.

Thus, computer security can be defined as the controls that are used to ensure the confidentiality, integrity, and availability of all components of computer systems. Let's refine the definition.

The CIA Triad

Computer security is mainly concerned with three main areas:

• Confidentiality is ensuring that information is available only to the intended audience
• Integrity is protecting information from being modified by unauthorized parties
• Availability is protecting information from being modified by unauthorized parties
In simple terms, computer security ensures that information and computer components can be used, but are protected from people or software that should not access or modify them.

Computer Security Threats

Computer security threats are potential dangers that can interfere with the normal operation of your computer. In the current era, cyber threats are constantly on the rise as the world becomes digital. The most dangerous types of computer security are:

Viruses

A computer virus is a malicious program that is downloaded onto a user's computer without their knowledge. It copies itself and infects files and programs on the user's computer. The ultimate goal of the virus is to ensure that the victim's computer can never work properly or can't work at all.

Computer Worm

A computer worm is a program that can copy itself from one computer to another without human intervention. The potential risk here is that it will take up space on your computer's hard drive, because the worm can replicate at a larger scale and at a faster rate.

Phishing

Disguising as a trusted person or company, phishers try to steal sensitive financial or personal information through fraudulent email or instant messaging. Phishing, unfortunately, is very easy to pull off. You are deluded into thinking that this is a legitimate mail and you can enter your personal information.

Ransomware

Ransomware is malware designed to deny a user or organization access to files on their computer. By encrypting these files and demanding a ransom for the decryption key, cyber attackers put organizations in a position where paying the ransom is the easiest and cheapest way to regain access to their files.

Botnet

A botnet is a group of computers connected to the Internet that have been compromised by a hacker using a computer virus. A single computer is called a "zombie computer". The result of this threat is the victim's computer, which the bot will use for malicious activities and for a larger attack such as DDoS.

Rootkit

A rootkit is a computer program designed to provide continued privileged access to a computer while actively hiding its presence. Once a rootkit has been installed, the controller of the rootkit will be able to remotely execute files and change system configurations on the host machine.

Key logger

Key loggers, also known as keystroke loggers, can track user activity on their computer in real time. It keeps a record of all keystrokes made by the user on the keyboard. A key logger is also a very powerful threat to steal people's credentials such as username and password.
These are perhaps the most common security threats you will encounter. Apart from this, there are others such as spyware, wabbits, scareware, bluesnarfing and many more. Fortunately, there are ways to protect yourself from these attacks.

Why is Computer Security Important?

In this digital era, we all want to keep our computers and our personal information secure and hence computer security is important to keep our personal information protected. It is also important to maintain our computer security and its overall health by preventing viruses and malware which would impact on the system performance.

Computer Security Best Practices

These days, computer security threats are getting more and more inventive. It is imperative for a person to be armed with information and resources to protect against these complex and growing computer security threats and stay safe online. Some preventive measures you can take include:
• Secure your computer physically by:
o Installing reliable, reputable security and anti-virus software
o Activating your firewall, because a firewall acts as a security guard between the internet and your local area network
• Stay up-to-date on the latest software and news surrounding your devices and perform software updates as soon as they become available
• Avoid clicking on email attachments unless you know the source
• Change passwords regularly, using a unique combination of numbers, letters and case types
• Use the internet with caution and ignore pop-ups, drive-by downloads while surfing
• Taking the time to research the basic aspects of computer security and educate yourself on evolving cyber-threats
• Perform daily full system scans and create a periodic system backup schedule to ensure your data is retrievable should something happen to your computer.

Other than that, there are many ways to protect your computer system. Aspects such as encryption and computer cleaners can help protect your computers and their files.

Today, due to the high level of cyber-attacks, cyber security is one of the biggest needs in the world as cyber security threats are very dangerous for the security of the country. Not only the government, but also the citizens should spread the word to the people to always keep your system and network security settings up to date and use the proper antivirus to keep your system and network security settings free from viruses and malware.

Unfortunately, the number of cyber threats is growing at a rapid pace, and more and more sophisticated attacks are emerging. Thus, having a good foundation in cybersecurity concepts will allow you to protect your computer from ever-evolving cyber threats.