Hiring a Cyber Security Incident Analyst - Revision history

Mavald at 16:59, 1 May 2022

2022-05-01T16:59:20Z

← Older revision		Revision as of 19:59, 1 May 2022
Line 610:		Line 610:
	sides and develop them with knowledge of weaker side, in order to know,		sides and develop them with knowledge of weaker side, in order to know,
	when to as for help.		when to as for help.
			==Sources==

Mavald: /* Digital forensics */

2022-05-01T16:21:40Z

Digital forensics

← Older revision		Revision as of 19:21, 1 May 2022
Line 111:		Line 111:
	examination, and analysis. All these four stages need a deep understanding of computers, technology across a broad spectrum, and cybersecurity principles and		examination, and analysis. All these four stages need a deep understanding of computers, technology across a broad spectrum, and cybersecurity principles and
	practices, a working knowledge of computers, networks, and coding, in-depth investigative abilities, critical-thinking skills and analytical talent the ability to effectively communicate and work with a		practices, a working knowledge of computers, networks, and coding, in-depth investigative abilities, critical-thinking skills and analytical talent the ability to effectively communicate and work with a
	wide range of people. <ref name="~~ecpi~~">"Digital forensics". Available: https://www.ecpi.edu/blog/what-is-digital-forensics-in-cybersecurity-is-this-a-good-career-for-me. [Accessed 26 4 2022].</ref>		wide range of people. <ref name="ecpi1">"Digital forensics". Available: https://www.ecpi.edu/blog/what-is-digital-forensics-in-cybersecurity-is-this-a-good-career-for-me. [Accessed 26 4 2022].</ref>

	====Mobile device management====		====Mobile device management====

Mavald: /* Future */

2022-05-01T16:21:01Z

Future

← Older revision		Revision as of 19:21, 1 May 2022
Line 579:		Line 579:
	2024.<ref name="franklin"></ref>		2024.<ref name="franklin"></ref>

	~~<p>https://www.franklin.edu/blog/is-a-masters-degree-in-cyber-security-worth-it</p>~~		Most likely this trend is also similar in other countries.</p>
	~~<p>~~Most likely this trend is also similar in other countries.</p>
	~~<p>~~When checking Estonian job portals, there is a constant need for		When checking Estonian job portals, there is a constant need for
	people for cyber security related positions. Also, linkedin search gives		people for cyber security related positions. Also, linkedin search gives
	approximately 30 vacancies immediately. There are banks, logistics		approximately 30 vacancies immediately. There are banks, logistics
	companies, e-shops, and software producers.</p>		companies, e-shops, and software producers. <ref name="linkedin">LinkedIn, "Cyber Security Jobs". Available: ttps://ee.linkedin.com/jobs/cyber-security-jobs?countryRedirected=1&position=1&pageNum=0 [Accessed 28 April 2022].</ref>
	~~<p>https~~://ee.linkedin.com/jobs/cyber-security-jobs?countryRedirected=1&position=1&pageNum=0</p>
	~~<p>~~Trends that affect companies create need for constant cyber security		Trends that affect companies create need for constant cyber security
	services. Increasing number of home/remote offices require secure		services. Increasing number of home/remote offices require secure
	corporate networks and security of remote devices. One example is from		corporate networks and security of remote devices. One example is from
	this year, when sloppy remote desktop set-up paralyzed systems of 17		this year, when sloppy remote desktop set-up paralyzed systems of 17
	companies.~~</p>~~		companies.
	<p>~~https~~://www.aripaev.ee/uudised/2022/04/20/ria-lohakas-kaugtoolaua-seadistus-halvas-martsis-vahemalt-17-juhul-ettevotete-it-susteemid</p>		<ref name="aripaev">Äripäev, "RIA: lohakas kaugtöölaua seadistus halvas märtsis 17 ettevõtte IT-süsteemid"Available: ttps://www.aripaev.ee/uudised/2022/04/20/ria-lohakas-kaugtoolaua-seadistus-halvas-martsis-vahemalt-17-juhul-ettevotete-it-susteemid [Accessed 28 April 2022].</ref>
	~~<p>~~Also, no service can exists without robust infrastructure - servers,
			Also, no service can exists without robust infrastructure - servers,
	databases, applications. As all previously mentioned devices and		databases, applications. As all previously mentioned devices and
	services are at constant scanning and surveillance. So, the breach		services are at constant scanning and surveillance. So, the breach
Line 601:		Line 602:
	to repel next attacks. So data recovery and evidence collection is		to repel next attacks. So data recovery and evidence collection is
	another important field of work that need skilled and professional		another important field of work that need skilled and professional
	workers.~~</p>~~		workers.
	~~<p>~~Even, if the specifics of the entity, be it CSIRT, CERT or SOC, are		Even, if the specifics of the entity, be it CSIRT, CERT or SOC, are
	different, the fundamentals of the work are the same. Professional		different, the fundamentals of the work are the same. Professional
	knowledge of the networks, operational systems, hardware, scripting, and		knowledge of the networks, operational systems, hardware, scripting, and
Line 608:		Line 609:
	single way to reach to it, every single person can find one’s strongest		single way to reach to it, every single person can find one’s strongest
	sides and develop them with knowledge of weaker side, in order to know,		sides and develop them with knowledge of weaker side, in order to know,
	when to as for help.~~</p>~~		when to as for help.

	~~</body>~~
	~~</html>~~

Mavald: /* Future */

2022-05-01T16:16:10Z

Future

Mavald: /* Communicating with employees, shareholders, customers, and the press about incidents as needed */

2022-05-01T16:12:37Z

Communicating with employees, shareholders, customers, and the press about incidents as needed

← Older revision		Revision as of 19:12, 1 May 2022
Line 489:		Line 489:
	===Managing internal communications and updates during or immediately after incidents occur===		===Managing internal communications and updates during or immediately after incidents occur===
	===Communicating with employees, shareholders, customers, and the press about incidents as needed===		===Communicating with employees, shareholders, customers, and the press about incidents as needed===
	~~<p>~~There are various services within the CSIRT Services Framework that		There are various services within the CSIRT Services Framework that
	address communications, as they relate to security operations and		address communications, as they relate to security operations and
	incident response services. Some of these include Information Security		incident response services. Some of these include Information Security
Line 499:		Line 499:
	communications. Each scenario may be unique, and careful consideration		communications. Each scenario may be unique, and careful consideration
	should be given to when to release information to the public and what		should be given to when to release information to the public and what
	information should be released.~~</p>~~		information should be released.
			<ref name="CMUni">Carniege Mellon University, Brittany Manley, David McIntire "A Guide to Effective Incident Management Communications". https://resources.sei.cmu.edu/asset_files/Handbook/2021_002_001_651819.pdf [Accessed 28 April 2022].</ref>
	<p>https://resources.sei.cmu.edu/asset_files/Handbook/2021_002_001_651819.pdf</p>

	===Remediating incidents===		===Remediating incidents===

Mavald: /* Investigating and analyzing incidents */

2022-05-01T16:10:41Z

Investigating and analyzing incidents

← Older revision		Revision as of 19:10, 1 May 2022
Line 485:		Line 485:
	procedures that inhibited the efficient resolution of the reported		procedures that inhibited the efficient resolution of the reported
	problem.		problem.
	<p>https://www.cisa.gov/uscert/bsi/articles/best-practices/incident-management/defining-computer-security-incident-response-teams</p>		<ref name="cisa">CISA (Cybersecurity & Infrastructure Security Agency, "Defining Computer Security Incident Response Teams". https://www.cisa.gov/uscert/bsi/articles/best-practices/incident-management/defining-computer-security-incident-response-teams [Accessed 28 April 2022].</ref>

	===Managing internal communications and updates during or immediately after incidents occur===		===Managing internal communications and updates during or immediately after incidents occur===

Mavald: /* Creating and maintaining an incident response plan (IRP) */

2022-05-01T16:09:07Z

Creating and maintaining an incident response plan (IRP)

← Older revision		Revision as of 19:09, 1 May 2022
Line 472:		Line 472:
	in the first place, or not follow proper protocol to contain the threat		in the first place, or not follow proper protocol to contain the threat
	and recover from it when a breach is detected.		and recover from it when a breach is detected.
			<ref name="stratacore">Stratacore, "Incident Response Plan (IRP)". https://www.stratacore.com/incidentresponseplan [Accessed 28 April 2022].</ref>

	~~https://www.stratacore.com/incidentresponseplan~~
	===Investigating and analyzing incidents===		===Investigating and analyzing incidents===
	CSIRTs are also involved in improvement activities. After major		CSIRTs are also involved in improvement activities. After major

Mavald: /* CERT */

2022-05-01T16:05:58Z

CERT

Mavald: /* Understand the primary roles and characteristics of a CERT, CSIRT, and SOC. */

2022-05-01T16:01:07Z

Understand the primary roles and characteristics of a CERT, CSIRT, and SOC.

← Older revision		Revision as of 19:01, 1 May 2022
Line 562:		Line 562:
	on behalf of a country or an organization. A SOC is where a country or		on behalf of a country or an organization. A SOC is where a country or
	organization monitors and defends its network, servers, applications,		organization monitors and defends its network, servers, applications,
	and endpoints.</p>		and endpoints. <ref name="exabeam"></ref>

	==Future==		==Future==

Mavald: /* Difference between SOC/CSIRT/CERT */

2022-05-01T16:00:57Z

Difference between SOC/CSIRT/CERT

← Older revision		Revision as of 19:00, 1 May 2022
Line 553:		Line 553:
	operations center (SOC). To add to this confusion, frequently, the terms		operations center (SOC). To add to this confusion, frequently, the terms
	CERT and CSIRT are used interchangeably, despite the important		CERT and CSIRT are used interchangeably, despite the important
	differences.		differences. <ref name="exabeam"></ref>

	==Understand the primary roles and characteristics of a CERT, CSIRT, and SOC.==		==Understand the primary roles and characteristics of a CERT, CSIRT, and SOC.==

← Older revision		Revision as of 19:16, 1 May 2022
Line 569:		Line 569:
	increased by 11 percent from 2017 to 2018. The cost of such breaches is		increased by 11 percent from 2017 to 2018. The cost of such breaches is
	astronomical–about $600 billion worldwide, according to the Economic		astronomical–about $600 billion worldwide, according to the Economic
	Impact of Cybercrime report.~~</p>~~		Impact of Cybercrime report.
	<p>https://www.ecpi.edu/blog/what-is-digital-forensics-in-cybersecurity-is-this-a-good-career-for-me</p>		<ref name="ecpi">ECPI, "What-is-digital-forensics-in-cybersecurity". Available: https://www.ecpi.edu/blog/what-is-digital-forensics-in-cybersecurity-is-this-a-good-career-for-me [Accessed 27 April 2022].</ref>
	~~<p>~~Job projections for cybersecurity are staggering. The Bureau of Labor
			Job projections for cybersecurity are staggering. The Bureau of Labor
	Statistics in US predicts that careers in the cybersecurity field will		Statistics in US predicts that careers in the cybersecurity field will
	grow by 32% by 2028. That makes cybersecurity one of the top 10		grow by 32% by 2028. That makes cybersecurity one of the top 10
	fastest-growing jobs in the country. In the United States alone, jobs		fastest-growing jobs in the country. In the United States alone, jobs
	for Information Security Analysts are expected to grow by 15% by		for Information Security Analysts are expected to grow by 15% by
	2024.</p>		2024.<ref name="franklin"></ref>

	<p>https://www.franklin.edu/blog/is-a-masters-degree-in-cyber-security-worth-it</p>		<p>https://www.franklin.edu/blog/is-a-masters-degree-in-cyber-security-worth-it</p>
	<p>Most likely this trend is also similar in other countries.</p>		<p>Most likely this trend is also similar in other countries.</p>

← Older revision		Revision as of 19:05, 1 May 2022
Line 521:		Line 521:

	==CERT==		==CERT==
	~~<p>~~The term “computer emergency response team” was coined in 1988. In		The term “computer emergency response team” was coined in 1988. In
	response to the Morris worm attack that impacted thousands of servers on		response to the Morris worm attack that impacted thousands of servers on
	the Internet, DARPA funded the formation of the Computer Emergency		the Internet, DARPA funded the formation of the Computer Emergency
Line 533:		Line 533:
	interchangeably with CSIRT, though the charter of a CERT is information		interchangeably with CSIRT, though the charter of a CERT is information
	sharing in order to help other response teams respond to threats against		sharing in order to help other response teams respond to threats against
	their own infrastructure.</p>		their own infrastructure. <ref name="exabeam"></ref>
	~~<p>https://www.exabeam.com/incident-response/csirt/~~</p>
	~~<p>~~In general, the designation of CERT is helpful in applying real-world		In general, the designation of CERT is helpful in applying real-world
	solutions to various cybersecurity problems. They may be government		solutions to various cybersecurity problems. They may be government
	contractors or employees of a major corporation. For example, the U.S.		contractors or employees of a major corporation. For example, the U.S.
	Computer Emergency Readiness Team (US-CERT) operates under the U.S.		Computer Emergency Readiness Team (US-CERT) operates under the U.S.
	Department of Homeland Security.~~</p>~~		Department of Homeland Security.
	<p>https://www.techopedia.com/definition/31003/computer-emergency-response-team-cert</p>		<ref name="techopedia">Techopedia, "Computer Emergency Response Team (CERT)". Available: https://www.techopedia.com/definition/31003/computer-emergency-response-team-cert. [Accessed 25 April 2022].</ref>
	~~<p>~~In Estonia CERT is designated as CERT-EE. It was established in 2006,
			In Estonia CERT is designated as CERT-EE. It was established in 2006,
	as an organization responsible for the management of security incidents		as an organization responsible for the management of security incidents
	in .ee computer networks. It is also a national contact point for		in .ee computer networks. It is also a national contact point for
	international co-operation in the field of IT security.</p>		international co-operation in the field of IT security. <ref name="ria">Information System Autority, "CERT-EE". Available: hhttps://www.ria.ee/en/cyber-security/cert-ee.html [Accessed 25 April 2022].</ref>
	~~<p>https~~://www.ria.ee/en/cyber-security/cert-ee.html</p>
	==Difference between SOC/CSIRT/CERT==		==Difference between SOC/CSIRT/CERT==
	[[File:analystimage3.png\|300px\|thumb\|SOC/CSIRT/CERT <ref name="exabeam></ref>]]		[[File:analystimage3.png\|300px\|thumb\|SOC/CSIRT/CERT <ref name="exabeam></ref>]]