1 of 21

2 of 21

Confessions of a Cyber Defender: Truths from the SOC trenches

For a More Secure Society

Yiğit Borucu & Bram van Dooremaal

3 of 21

$whoami

Introduction

For a More Secure Society

3

Yiğit Borucu

Senior SOC Analyst

2 years at Fox-IT

Bram van Dooremaal

Senior SOC Analyst

3.5 years at Fox-IT

4 of 21

$whoami /groups

A big team with a lot of knowledge

  • Monitoring, analysing and reporting
  • 24/7 coverage
  • First SOC in Europe
  • Around 63 Analysts
  • Full and Part-timers

For a More Secure Society

4

5 of 21

We want to know more about you!

For a More Secure Society

5

6 of 21

From calm to chaos

  • Every second matters
  • TU Eindhoven
  • Analyse & Communicate

A ticking time bomb

For a More Secure Society

6

7 of 21

Anomalous IoT Devices

  • IoT devices can be fun
  • Unexpected scans all over the place

When the Coffee Machine becomes a threat

For a More Secure Society

7

8 of 21

Has your IoT device acted differently?

For a More Secure Society

8

9 of 21

Geopolitics

Real World impacts the digital

For a More Secure Society

9

Real world influences the threat assesment in�both directions

Sometimes there are also ethical questions as a�result of geopolitics.

Aftermath of Israel-Palestine escalation.�HAMAS affiliated Domain in DNS Lookup (alqassam .ps)

“One interesting trend we see is, in the last month or two, ransomware is actually down. There’s probably a lot of different reasons why that is, but I think one impact is the fallout of Russia-Ukraine. As we do sanctions and it’s harder to move money and it’s harder to buy infrastructure on the web, we’re seeing them be less effective – and ransomware is a big part of that.”

~ Rob Joyce, NSA Director of Cybersecurity, 2022

10 of 21

Stronger Together

  • We are not alone
  • From a NATO summit to pentest

Collaborations

For a More Secure Society

10

SDM

Red Team

Forensic Experts

Threat Intell.

SOC

11 of 21

Triple A: Alarms, Alerts and Adrenaline

The challenge you have to face

Fatigue + unpredictable events = intense day

Routine

Adapt and thrive

Smart routines, good playlists, and coffee save the day

Shifts

Waking up at 5am for a 7am shift

SOC Analyst

Adrenaline

Analyse Incident

For a More Secure Society

11

12 of 21

The SOC Jet Lag

  • 3 shifts. Endless Rotation.
  • Constant jet lag... But long weekends rock! (A hair cut on a Tuesday afternoon!)
  • Good night shifts

The good and the bad

For a More Secure Society

12

WEEK 1

WEEK 2

WEEK 3

WEEK 4

WEEK 5

M

T

W

T

F

S

S

M

T

W

T

F

S

S

M

T

W

T

F

S

S

M

T

W

T

F

S

S

M

T

W

T

F

S

S

Working

13 of 21

Fatigue

  • Alert fatigue is real, for both sides
  • Backlogs grow - Queues flood
  • Repetition = exhaustion
  • Filtering & feedback loops
  • Focus on what really matters

A single needle in a mountain of haystacks

For a More Secure Society

13

14 of 21

The cycle of growth

  • The best place to start
  • Frontline experience difficult to get anywhere else
  • Exposure to tools, tactics and attacker mindset
  • Constant knowledge
  • From SOC -> Red Team, IR, Threat hunting, Engineering

How Foxers stay Foxers

For a More Secure Society

14

SOC

RED TEAM

DFIR

Threat hunting

Engineering

15 of 21

What kind of security incident or challenges did you face and how did you deal with it?

For a More Secure Society

15

16 of 21

When silence is not the answer

  • SSH keys & AWS credentials exfiltrated

For a More Secure Society

16

Malware

Execution

Exfiltration

17 of 21

When silence is not the answer

For a More Secure Society

17

Observe

Analyse

Create Report

Call

Escalate

01

02

03

04

05

18 of 21

When silence is not the answer

For a More Secure Society

18

Observe

Analyse

Create Report

Call

Call again

Escalate

01

02

03

04

05

06

19 of 21

When silence is not the answer

For a More Secure Society

19

Observe

Analyse

Create Report

Call

Call again

And again

Escalate

01

02

03

04

05

06

07

20 of 21

When silence is not the answer

  • SSH keys & AWS credentials exfiltrated
  • 30 calls no answer

For a More Secure Society

20

Would you want us to keep calling?

21 of 21

Thank you

Q&A Time!

For a More Secure Society