Ruslan Rakhmetov, Security Vision
Analysts in SOC (Security Operations Centre) are specialists who monitor the security of IT systems, complexes and business processes and respond to incidents. To become such an analyst, you need to fulfil certain requirements. The world of information security is constantly evolving: new types of information protection tools appear, attackers develop their methods and invent new tactics, new technologies and methods of data collection appear. Therefore, a modern analyst should constantly learn and hone his skills, just as a good doctor needs to study diagnostic and treatment methods to make new breakthroughs in medicine.
Knowledge of IT and cybersecurity fundamentals
For a cyber incident response and analysis centre analyst, knowing and understanding cybersecurity principles is the backbone of the job. Key aspects include:
1) Basic cybersecurity concepts, CIA triad: confidentiality, integrity and availability
- Confidentiality is the protection of information from unauthorised access. Imagine locking important documents in a safe and only those people with the key can read them. In information security, this aspect of the triad is responsible for protecting data so that no one else can access it.
- Integrity ensures that the data remains unchanged and accurate. It's like making sure that an email arrives as it was sent, unchanged and uninterrupted. In cybersecurity, it is important that no one can discreetly alter or tamper with data that is stored somewhere and passed from system to system.
- Availability is about ensuring that information and systems are always available when you need them. For example, in life it is like having access to electricity at home at all times (when it goes out, problems arise), and it is especially critical, for example, not in a normal home where you can temporarily make do with candles for lighting, but in critical facilities such as hospitals where without working machines, patients can lose their lives. In IS, this means that services run consistently and smoothly, the company fulfils its objectives, and customers get the service they want.
2) Know the types of cyber attacks
Earlier we have already told you about various methods of social engineering, when attackers focus on the weakest link of the system - a person. Among such methods are quite common:
- Phishing (attempts to trick out personal information using fake emails or websites, for example, when a letter arrives from a ‘bank’ where ‘employees’ ask you to urgently enter your data - in real life it is a fraudster who pretends to be a bank employee);
- DDoS-attacks (Distributed Denial of Service) - attacks in which attackers overload the site with requests (it becomes inoperable for users, i.e. the availability of data, which we talked about above, is violated), it is as if 100 people suddenly came to the cafe at the same time and the waiters would not have time to serve all of them;
- SQL injection - attacks where attackers inject malicious code into database queries (so they can gain access to the data, violating the privacy aspect). Imagine writing a query into a search box and an attacker stealthily adds their commands to it.
- Password attacks - attempting to break into accounts through password mining or theft) This is similar to trying to find the key to a flat door;
- Malware, i.e. software that can damage a computer, steal data or spy on the user. Imagine having a programme on your phone that discreetly reads all messages or takes screenshots and sends them to an attacker.
3) Knowledge of attack tactics and methods, basic attack vectors, and methods of detection
There are a lot of frameworks - knowledge bases that aim to decompose the actions of attackers and predict their future actions. We have already analysed various threat databases, but we will remind you of some of the data in the current review:
- OWASP TOP 10 is a list of the most common web application vulnerabilities. It can be thought of as a ‘list of the most popular traps’ that attackers use to compromise websites;
- CVE (Common Vulnerabilities and Exposures) is a database of known vulnerabilities that analysts are constantly working with to keep abreast of weaknesses in systems;
- MITRE ATT&CK is a database of attack tactics and techniques that helps analysts understand how attackers operate at different stages of an attack. It's like a textbook with action plans for criminals;
- Cyber Kill Chain is a model that describes the stages of a cyber attack from reconnaissance to completion. An analyst using this model can determine what stage the attack is in and how to stop it.
The analyst should be able to recognise the various ‘traps’ and prevent exploitation of vulnerabilities or execution of sophisticated attacks.
Speaking about the key stages of the incident lifecycle, from the general list we can distinguish: detection (it is as if you notice that someone is trying to break into a lock), response (this is actions to prevent a break-in, for example, calling security guards or reinforcing locks), elimination (if we use the example of breaking a lock - its replacement) and recovery - returning the system to a normal state after the incident. Modern SOAR-class systems allow automating various actions not only at these stages of the Kill Chain, so similar technologies can be applied to help analysts.
An analyst in a SOC should be able to quickly recognise signs of an attack, such as strange logins or suspicious traffic, then perform IP blocking, disabling infected devices or temporarily shutting down systems to protect them. The remediation and recovery phases are responsible for removing malware, restoring data, and ensuring that the vulnerability is closed. It's as if you've installed new, more secure locks and conducted an audit of all your belongings in the house, similar to the asset management and inventory process in IT and IS.
4) Technical skills
This is an important part of being a SOC analyst and includes knowledge of operating systems, command line and scripting skills, and an understanding of virtualisation and cloud technologies. We'll look at each aspect in more detail in our next article on analyst jobs.
To do your job effectively, you need to know where the doors, cameras and how the alarms work. In cybersecurity, it's knowing how networks, computers, operating systems, and what viruses or attacks are. In addition to this knowledge, the response team specialist and analysts at all levels will benefit from pumping up their soft skills such as:
- Data Analysis Skills. This is similar to the ability to see unusual details in a crowd of people. For example, if a person is behaving suspiciously, a security guard or customs officer at an airport will take notice. An analyst in a SOC does the same thing, but with data. He or she analyses network traffic and event logs to spot anomalies - signs of hacking or data breaches;
- The ability to react quickly. Imagine you are a firefighter and you need to act quickly and decisively if there is a fire somewhere. In a SOC, if an analyst sees a threat, he or she must react immediately: block attacks, stop malware, or isolate infected systems;
- Teamwork. Just like in football, a successful defence is always the result of teamwork. In a SOC, analysts work together to identify threats and eliminate them. They share information, test each other and help find better solutions;
- Communication skills. When a mechanic explains to a car owner what needs to be fixed, he must speak in simple language. The SOC analyst must also be able to convey information: to colleagues, managers or even non-technical employees. He explains complex things in simple words so that everyone understands what happened and what needs to be done;
- Attention to detail. Imagine the work of a watchmaker who assembles a complex mechanism: one wrong step and the clock will not start. An analyst must notice the smallest deviations in the system that could indicate a threat. This helps prevent attacks at an early stage;
- Learning and curiosity. Like a chef who is constantly trying new recipes, a SOC analyst must always be learning. Hackers are coming up with new attack methods and the analyst must be willing to learn them, master new tools and technologies to stay ahead of the curve.
Our experts have developed a checklist of requirements for SOC analysts that you can use when searching for and recruiting a top-notch specialist.
1) Knowledge and understanding of cybersecurity principles:
- Basic cybersecurity concepts;
- knowledge of types of cyber attacks;
- knowledge of attack tactics and methods, key attack vectors, and detection methods;
- understanding of the key stages of the incident lifecycle;
2) Log analysis skills
- Experience in working with various log formats
- Ability to analyse operating system event logs;
- analysing logs of network devices (firewalls, routers);
- analysing application and server logs;
3) Networking skills
- Basic knowledge of network technologies and knowledge of the OSI model;
- basic knowledge of network protocols (TCP/IP, HTTP, DNS, DHCP);
- understanding of network topologies, devices and their roles;
- ability to analyse network traffic to detect anomalies;
- knowledge of network monitoring and traffic analysis systems;
To this list you can add the basics of working with operating systems (Windows, Linux), the ability to use the command line and scripting languages to analyse and automate processes (Bash, PowerShell), knowledge of the basic concepts of virtualisation and cloud technologies and experience of working with security tools, which we will talk about in the second part of the review.
.jpg)
.jpg)
