Even top companies like Google, Microsoft, Amazon, IBM, Facebook, and Dell all hire cyber security professionals.

即使是谷歌、微軟、亞馬遜、IBM、Facebook 和戴爾這樣的頂級公司，也都會聘用網絡安全專業人員。

The cyber security industry has a 0% unemployment rate.

網絡安全行業的失業率為 0%。

The average salary for an entry level cyber security job is about $100,000 per year in the United States.

在美國，初級網絡安全工作的平均年薪約為 100,000 美元。

Furthermore, you don't need to know coding and learn from your home, and you get a scholarship to kick start your career.

此外，你不需要懂編碼，在家就能學習，還能獲得獎學金，開啟你的職業生涯。

Apply now.

立即申請

EC Council is pledging a $3.5 million CCT scholarship for cyber security career starters.

歐洲委員會理事會承諾為網絡安全職業新手提供 350 萬美元的 CCT 獎學金。

Scan the QR code on the screen to apply for the scholarship.

掃描螢幕上的二維碼申請獎學金。

Fill out the form.

填寫表格。

Hello everyone, and welcome to today's session, Effective Soft Management and Incident Response.

大家好，歡迎參加今天的會議：有效的軟管理和事件響應。

I'm Shilpa Goswami, and I'll be your host for the day.

我是希爾帕-戈斯瓦米，今天由我來主持。

Before we get started, we would like to go over a few house rules.

在開始之前，我們想先談一下一些內部規則。

For our attendees, the session will be in listen-only mode and will last for an hour, out of which the last 10 minutes will be dedicated to Q&A.

對於我們的與會者來說，會議將採用只聽模式，持續一個小時，其中最後 10 分鐘將用於問答。

If you have any questions during the webinar to organizers or our speaker, use the Q&A window.

如果您在網絡研討會期間向組織者或主講人提出任何問題，請使用問答窗口。

Also, if you face any audio or video challenges, please check your internet connections or you may log out and log in again.

此外，如果您遇到任何音頻或視頻問題，請檢查您的網絡連接，或者您可以退出並重新登錄。

An important announcement for our audience.

向觀眾宣佈一個重要消息。

As a commitment to closing the cyber security workforce gap by creating multi-domain cyber technicians, EC Council pledges $3.5 million towards CCT education and certification scholarship to certify approximately 10,000 cyber professionals ready to contribute to the industry.

作為通過培養多領域網絡技術人員來彌補網絡安全人才缺口的承諾，歐洲委員會理事會承諾為 CCT 教育和認證獎學金提供 350 萬美元，以認證約 10,000 名網絡專業人員，使他們能夠為該行業做出貢獻。

If you want to know more, kindly visit our website given in the chat section.

如果您想了解更多資訊，請訪問我們在哈拉部分提供的網站。

Also, we would like to announce to audiences about the special handouts.

此外，我們還想向觀眾宣佈一些特別的派送活動。

Take the screenshot of the running webinar and post in your social media LinkedIn, Twitter tagging, EC Council, and hashtag CyberTalks.

截取網絡研討會的運行截圖併發布到您的社交媒體 LinkedIn、Twitter 標記、EC Council 和 hashtag CyberTalks 上。

We will share free handouts to first 15 audience.

我們將向前 15 名觀眾免費派發講義。

Our speaker for today's session, Randy Thomas.

今天會議的主講人是蘭迪-托馬斯。

He is responsible for the SOC security product development, which includes detection as code,

他負責 SOC 安全產品開發，其中包括代碼檢測、

DIFI, incident command, vulnerability management, threat intelligence, driven security operations, threat hunting, and offensive security at Syntex, a leading managed cloud provider.

在領先的託管雲提供商 Syntex 負責 DIFI、事件指揮、漏洞管理、威脅情報、驅動型安全營運、威脅獵取和攻擊性安全。

He has over 21 years of experience in enterprise cyber security in a wide range of environments, including the US military and intelligence, commercial e-com, detail, and MSSP, MSSSP markets.

他在企業網絡安全領域擁有超過 21 年的豐富經驗，涉及美國軍事和情報、商業電子商務、細節以及 MSSP 和 MSSSP 市場等多種環境。

He leverages his combined 28 plus years of enterprise IT experience and 18 years of experience in DevOps, DevSecOps, SOC, security engineering, and software development to deliver high quality security products and solutions.

他擁有 28 年以上的企業 IT 經驗和 18 年的 DevOps、DevSecOps、SOC、安全工程和軟件開發經驗，能夠提供高質量的安全產品和解決方案。

Without any further delay, I will hand over the session to you, Randy.

蘭迪，不再耽擱，我將把會議交給你。

Thank you, Shilpa.

謝謝你，希爾帕。

Good day, everyone.

大家好

Thank you for taking this time to join the webinar, either live or later recorded.

感謝您抽出寶貴時間參加網絡研討會，無論是現場直播還是稍後的錄製。

Today, we're going to talk about management and leadership in security operations.

今天，我們來談談安全營運中的管理和領導力。

As with all things cyber security, it is iterative and you're always learning, regardless of your role and position inside of a SOC.

與所有網絡安全工作一樣，無論你在 SOC 中擔任什麼角色和職位，都需要不斷迭代和學習。

Overview of what we're going to discuss, we're going to talk about what is a SOC, that varies.

綜上所述，我們要討論的是什麼是 SOC，這一點各不相同。

What are the business cases that you're using to defend your organization?

您用什麼業務案例來為您的組織辯護？

What's the role of a leader?

領導者的角色是什麼？

How do you plan and organize your team?

如何規劃和組織團隊？

Give an example and talk through a threat intelligence driven SOC lifecycle, something that can be done regardless of your maturity.

舉例說明威脅情報驅動的 SOC 生命週期，無論您的成熟度如何，都可以做到這一點。

Go into some measures of effectiveness so you can know where you're at and know where you're going.

對成效進行一些衡量，這樣你就能知道自己的現狀，也能知道自己的未來。

And give an example of iterative growth of a SOC.

並舉例說明 SOC 的迭代增長。

And this is from a personnel progression, personnel growth standpoint.

這是從人員進步、人員成長的角度來看的。

And then have some further research for you that are interested, either are in a leadership position or interested in it, or just want to know how leaders in operations think.

然後為有興趣的人提供一些進一步的研究，這些人可能正擔任領導職務或對此感興趣，或者只是想了解營運領域的領導者是如何思考的。

So I've seen SOCs that have been everything from a SIM tool in an IT shop of one person to actually being responsible for not only the security operations, but the digital forensics, incident response, the threat intelligence work, the hunt work, building cyber threat intelligence products, offensive security, vulnerability management, SIM operation, and maybe engineering.

是以，我所見過的 SOC 從一個人的 IT 部門中的 SIM 工具，到實際上不僅負責安全營運，還負責數字取證、事件響應、威脅情報工作、狩獵工作、構建網絡威脅情報產品、攻擊性安全、漏洞管理、SIM 操作，甚至工程。

And likewise for EDR and other platforms.

同樣，EDR 和其他平臺也是如此。

In my background, I've had to do the extremes there.

在我的背景中，我不得不做一些極端的事情。

So it comes across.

所以，它就出現了。

So understanding what your responsibilities are, very important.

是以，瞭解自己的責任非常重要。

So another area that you want to look at as a security operations leader is at some point to create a charter and write down your roles, your responsibilities, and really the limits of what the SOC can do.

是以，作為安全營運領導者，您需要關注的另一個方面是，在某些時候創建一個章程，並寫下您的角色、責任以及 SOC 的真正權限。

And that can cover a lot of things, and you want that to be an iterative and a learning or a living document, and not just let it sit on a shelf.

它可以涵蓋很多內容，你希望它成為一個迭代、學習或有生命力的文件，而不是讓它束之高閣。

It should be something you come back and look at, whether it be during exercises or during actual incidents.

無論是在演習中還是在實際事件中，這都應該是你回來查看的東西。

And it should be communicated across your organization with IT, with legal, with corporate communications, what have you.

此外，還應在整個組織內與信息技術部門、法律部門、企業傳播部門等進行溝通。

These are important.

這些都很重要。

They help reduce ambiguity where it exists, because as a security operations professional, you will deal with lots of ambiguity, lots of events that you cannot plan for.

它們有助於減少存在的模糊性，因為作為一名安全營運專業人員，你將處理大量的模糊性，處理大量你無法計劃的事件。

So when you can plan and can organize, do yourself a favor in your team and do that.

所以，當你能計劃、能組織時，就幫自己的團隊一個忙，去做這件事。

And that always is something you iterate on.

而這始終是你需要反覆斟酌的問題。

It's never stagnant, never stale.

永不停滯，永不陳舊。

So again, wherever we can, being proactive, being responsive is very important.

是以，在我們力所能及的範圍內，積極主動、有求必應同樣非常重要。

Be intentional where you can.

在可能的情況下，要有意識。

As a leader, it's important when you give directions and intent that you are not changing that constantly.

作為領導者，當你下達指令和意圖時，重要的是不要不斷改變指令和意圖。

You have a good path.

你有一條好路。

You have a good plan.

你的計劃很好

Obviously, you have to be able to adapt.

顯然，你必須能夠適應。

We'll talk more about the OODA loop later, you know, observe, orient, decide, and act.

我們稍後會詳細討論 OODA 循環，即觀察、定位、決定和行動。

That is a helpful tool in the process.

這是一個很有用的工具。

It's also important to either, one, establish, or two, take what is there and curate it so you look at your responsibilities, your roles.

同樣重要的是，一是要建立，二是要把現有的東西加以整理，這樣你就能看到自己的責任和角色。

A RACI matrix is a very good way to do that.

RACI 矩陣就是一個很好的方法。

It would go across your organization.

這將貫穿整個組織。

If you're in the MSP, Managed Service Provider, Managed Security Service Provider space, such as

如果您是 MSP、託管服務提供商、託管安全服務提供商，例如

Syntax is, we have to have those with each of our customers.

文法是，我們必須與我們的每一位客戶進行溝通。

That way, it's understood.

這樣就能理解了。

You also should build workflows that are accurate and reflect not only the RACI, but how that actually works in practice.

您還應該建立準確的工作流程，不僅要反映 RACI，還要反映實際工作中的實際情況。

It's very important that you take these things in mind and you always have the iterative life cycle development process.

重要的是，你要牢記這些事情，並始終堅持迭代生命週期開發流程。

Everything you do affects other aspects of the organization.

你所做的一切都會影響到組織的其他方面。

You know, think of it as throwing a boulder in a pond and the ripples in the water.

你知道，就像把一塊巨石扔進池塘，水面會泛起漣漪。

So, you have to be intentional about what you do.

是以，你必須用心去做。

Train how we fight.

訓練我們如何戰鬥

Use exercises.

使用練習。

Definitely do tabletop exercises, TTXs.

一定要做桌面練習、TTX。

Also, highly recommend operational exercises in the environment.

此外，強烈建議在環境中進行操作演練。

Do OPEXs and do them often.

做 OPEX，而且要經常做。

Internal to start with, internal to SOC, you know, expand it to security engineering if there is a security engineering organization.

從內部開始，從 SOC 內部開始，如果有安全工程組織，還可以擴展到安全工程。

Expand it from there.

從這裡開始擴展。

Include aspects of your enterprise IT.

包括企業 IT 的各個方面。

That could be different departments, different divisions, and then look at doing it with customers as well, especially if you have customer environments, particularly in MSSPs, where there is split roles and responsibilities across not only the customer, but inside the SOC as an MSSP as well.

這可以是不同的部門、不同的分部，也可以是客戶，特別是如果你有客戶環境，尤其是在 MSSP 中，不僅客戶有不同的角色和責任，作為 MSSP 的 SOC 內部也有不同的角色和責任。

Okay.

好的

A SOC is going to be in an organization that already exists.

SOC 將設在一個已經存在的組織中。

The organization does what the organization does.

組織做組織該做的事。

Perhaps it's an e-commerce company and they sell retail products online.

也許這是一家電子商務公司，他們在網上銷售零售產品。

Perhaps there's a mix with brick and mortar as well.

也許，磚和砂漿也是一種混合體。

Perhaps you're a governmental organization, what have you.

也許你是一個政府組織，諸如此類。

That exists.

那是存在的。

So, you need to understand things such as what are the business cases for the SOC.

是以，您需要了解 SOC 的業務案例是什麼。

You have to focus in and understand where the SOC fits in the larger organization.

你必須集中精力，瞭解 SOC 在更大組織中的位置。

It's also important to build and, again, curate an understanding of crown jewels.

同樣重要的是，要建立對皇冠上的明珠的瞭解，並再次加以整理。

It's often called a crown jewels analysis.

這通常被稱為皇冠上的寶石分析。

It's exactly what it sounds like.

聽起來就是這麼回事。

These are the top 10, the top 100 important things to the organization.

這是對組織最重要的 10 件事，也是最重要的 100 件事。

Again, to go back to what's why, this is what the organization is doing.

再次回到 "為什麼 "的問題，這就是本組織正在做的事情。

That typically would include not just technical, but personnel aspects as well.

這通常不僅包括技術方面，還包括人事方面。

If you've been in the industry for long, most breaches tend to occur via email, business email compromise, or BEC, huge, huge vector.

如果你在這個行業工作了很長時間，那麼大多數洩密事件往往都是通過電子郵件、商業電子郵件洩密或 BEC 發生的，這是一個巨大的載體。

What are some of the aspects of that?

其中有哪些方面？

Not only do you get the supply chain side attacks that are becoming more common, you also have the old but good attacks on invoice and wire fraud.

不僅有越來越常見的供應鏈方面的攻擊，還有古老而有效的發票和電匯欺詐攻擊。

So, your finance department could be a CFO.

是以，你的財務部門可以是首席財務官。

So, all of these people, your C-suite, your board, you have your HR department.

是以，所有這些人，你的 C-suite、你的董事會，還有你的人力資源部門。

We're out of, in the U.S., income tax season.

在美國，我們已經過了所得稅季。

That's also an issue as well with W-2 fraud, for instance, things like that.

這也是一個問題，比如 W-2 欺詐，諸如此類。

You want to identify those, not just the identity and access management IAM pieces, which, of course, you want to include, you know, endpoint, detect and respond, EDR, things such as that.

你要識別這些內容，而不僅僅是身份和訪問管理 IAM 部分，當然，你要包括端點、檢測和響應、EDR 等內容。

Boundary protection is fine.

邊界保護沒問題。

That's not a panacea, of course.

當然，這並不是萬能的。

Hence, other technologies such as zero trust, network access, CTNA coming about.

是以，零信任、網絡接入、CTNA 等其他技術應運而生。

So, you leverage this work you do as a leader putting this together to prioritize what you work on, whether it's adding new capabilities to the SOC, such as detection engineering, or how you respond.

是以，無論是為 SOC 增加新功能（如檢測工程），還是如何做出響應，您都可以利用作為領導者所做的這些工作來確定工作的優先級。

And this deserves mentioning because, unfortunately, I've been in environments that have done this.

這一點值得一提，因為不幸的是，我所處的環境就是這樣。

You can only actually have one number one priority.

實際上，你只能有一個頭等大事。

You cannot have A through Z.

不能從 A 到 Z。

You cannot have 26 number one priorities.

你不能有 26 個頭等大事。

You need to make choices.

你需要做出選擇。

The resources are always limited.

資源總是有限的。

Doesn't matter if you have a budget of $20,000 U.S. or $20 million.

預算是 2 萬美元還是 2000 萬美元並不重要。

You have severe limitations on what is achievable.

你的能力受到嚴重限制。

Also, some aspects to consider in a more holistic manner are words have meanings.

此外，還需要從更全面的角度考慮詞語的含義。

So, anything the SOC gets in from systems that are instrumenting, such as a SEM or other tools, is an event.

是以，SOC 從儀器系統（如 SEM 或其他工具）獲取的任何資訊都是一個事件。

The event came in potentially based upon an alert or as an informational feed.

該事件可能是根據警報或作為資訊饋送進來的。

So, the SOC has to determine whether it's manual or with automation, hopefully the latter.

是以，SOC 必須確定是人工操作還是自動化操作，希望是後者。

That's a growth area, right?

這是一個增長點，對嗎？

You have to build contextual reference and relevance to the event.

您必須建立與活動相關的背景參考和關聯性。

What does that mean?

這是什麼意思？

If you're in the retail space, for instance, or hospitality, your enemy number one is threat actors such as FinCET.

例如，如果你從事零售業或酒店業，你的頭號敵人就是 FinCET 這樣的威脅者。

This is how they act.

這就是他們的行為方式。

This is their tools, techniques, procedures, their TTPs.

這就是他們的工具、技術、程序、TTPs。

So, you look for things like that.

所以，你要尋找這樣的東西。

So, once something comes in as an event, the SOC, whether manually or automatically, either clears the event, the alert, or it's elevated to be a probable incident.

是以，一旦有事件發生，SOC 會手動或自動清除事件或警報，或者將其提升為可能發生的事件。

So thus, thus comes into play your incident handling process, which is a process if you don't have, definitely should make.

是以，這就涉及到事件處理流程，如果沒有這個流程，就一定要制定。

There's plenty of references.

有很多參考資料。

I have some at the end we can go over.

我最後還有一些，我們可以再看看。

And one other point of note, particularly in more mature organizations, they will have an information technology information library, ITIL, based IT service management process.

還有一點值得注意，特別是在比較成熟的組織中，他們會有一個基於信息技術服務管理流程的信息技術信息庫（ITIL）。

Those define incidents at the ITSM level.

這些定義了 ITSM 層面的事件。

That is not necessarily a security incident that comes in as an event and or an alert to the SOC.

這不一定是安全事件，不一定會作為事件或警報發送到 SOC。

In the SOC, we then, therefore, have to process that.

是以，在 SOC 中，我們必須對其進行處理。

Okay, being a SOC leader, we can manage our processes, manage our metrics, we can manage our timesheets and expense reports.

好了，作為一名 SOC 領導者，我們可以管理我們的流程，管理我們的指標，管理我們的時間表和費用報告。

When you're managing people, in my view, you've got some challenges to work through.

在我看來，當你管理員工時，你需要克服一些挑戰。

So, leadership is important.

是以，領導力非常重要。

Again, as I mentioned earlier, from a resource standpoint, it's always limited.

同樣，正如我前面提到的，從資源的角度來看，資源總是有限的。

You must be pragmatic.

你必須務實。

You cannot, nor should you really want to solve 100% of anything because when you start that process and when you finish it, it takes some period of time.

你不可能，也不應該真的想要百分之百地解決任何問題，因為當你開始這個過程，當你完成這個過程，都需要一段時間。

There's periodicity in there.

這裡面有週期性。

And the threat landscape typically evolves.

而威脅環境通常是不斷變化的。

So, whether it's cyber hygiene or full coverage, that can always be a challenge.

是以，無論是網絡衛生還是全面覆蓋，這始終是一個挑戰。

Now, obviously, full coverage of something like EDR, of other advanced authentication mechanisms such as MFA or other tools such as CyberArk, most certainly, those should be employed.

現在，顯然應該全面採用 EDR、MFA 等其他高級身份驗證機制或 CyberArk 等其他工具。

But you want close to 100% coverage.

但你想要接近 100% 的覆蓋率。

That's not the, of course, the intent of the discussion point there.

當然，這並不是討論的重點。

But understand that it's always evolving.

但要知道，它一直在發展。

We always have to iterate.

我們必須不斷改進。

So, as a leader in SOC, when everything else is on fire and there's chaos abounds because that's what a SOC has to deal with, right?

是以，作為 SOC 的領導者，當其他一切都著火了，到處都是混亂的時候，因為這就是 SOC 必須面對的，對嗎？

We deal with challenges from our customers, whether they're internal or external or both.

我們要應對來自客戶的挑戰，無論是內部挑戰還是外部挑戰，抑或是兩者兼而有之。

So, be calm, be consistent, do your best, learn, you know, have the sixth step in your six phases of incident response is your lessons learned, your after-action report, as many of us like to call it.

是以，要冷靜、堅持、盡力、學習，要知道，在事件響應的六個階段中，第六個步驟是總結經驗教訓，也就是我們很多人喜歡稱之為的 "行動後報告"。

So, get better afterwards.

所以，以後要好起來。

And again, everything we do has consequences, ripples in the pond, as I said.

再說一遍，我們所做的一切都會產生後果，就像我說的那樣，會在池塘裡激起漣漪。

As a leader, it's particularly important for you to either learn or continue to hone soft skills.

作為領導者，學習或繼續磨練軟技能尤為重要。

So, interpersonal communication is huge.

是以，人際溝通非常重要。

Body language is a huge part of that, even in video.

肢體語言是其中很重要的一部分，即使在視頻中也是如此。

You know, you need to have empathy for what the affected victim or victims are having to deal with and what the ramifications they will have to deal with with countermeasures.

你要知道，你需要同情受影響的受害者所要面對的一切，以及他們在採取反制措施後將不得不面對的後果。

You know, if you have an environment with 80,000 associates and there's no MFA, you can't just turn MFA on instantly because that goes back to crown jewels.

要知道，如果你有一個擁有 8 萬名員工的環境，卻沒有 MFA，你就不能立即開啟 MFA，因為這又回到了皇冠上的寶石。

If they're an e-com environment and nobody can get in to do the work, you can't sell anything.

如果是在電子商務環境中，沒有人能夠進入工作，你就什麼也賣不出去。

So, it takes balance.

是以，這需要平衡。

Crucial conversations happen.

關鍵的對話會發生。

Those are difficult conversations.

這些都是艱難的對話。

There is a course on that, which I took years ago.

有一門關於這個問題的課程，我幾年前學過。

It's very good.

非常好。

And human psychology.

還有人類心理學。

It's a great hobby to have, not just for self-growth, but in general, and particularly as a leader in cybersecurity.

這是一個很好的業餘愛好，不僅有利於自我成長，也有利於整體發展，尤其是作為網絡安全領域的領導者。

So, even as a director or as a C-suite, if you are responsible for operations and or engineering in the space, it is very important that you maintain some technical acumen.

是以，即使作為總監或首席執行官，如果您負責該領域的營運和工程，保持一定的技術敏銳度也非常重要。

So, have a lab.

所以，要有一個實驗室。

Spin up VMs in AWS, Azure, DigitalOcean, what have you.

在 AWS、Azure、DigitalOcean 等平臺上啟動虛擬機。

You know, and I like the example of can you do packet analysis?

我喜歡 "你能進行數據包分析嗎？

I can.

我可以

You know, it's something that is good to have as a basic fundamental skill, and doing protocol analyzer work, too, with Wireshark is also good.

使用 Wireshark 進行協議分析工作也很不錯。