Confessions of a Cyber Defender: Truths from the SOC trenches
For a More Secure Society
Yiğit Borucu & Bram van Dooremaal
$whoami
Introduction
For a More Secure Society
3
Yiğit Borucu
Senior SOC Analyst
2 years at Fox-IT
Bram van Dooremaal
Senior SOC Analyst
3.5 years at Fox-IT
$whoami /groups
A big team with a lot of knowledge
For a More Secure Society
4
We want to know more about you!
For a More Secure Society
5
From calm to chaos
A ticking time bomb
For a More Secure Society
6
Anomalous IoT Devices
When the Coffee Machine becomes a threat
For a More Secure Society
7
Has your IoT device acted differently?
For a More Secure Society
8
Geopolitics
Real World impacts the digital
For a More Secure Society
9
Real world influences the threat assesment in�both directions
Sometimes there are also ethical questions as a�result of geopolitics.
Aftermath of Israel-Palestine escalation.�HAMAS affiliated Domain in DNS Lookup (alqassam .ps)
“One interesting trend we see is, in the last month or two, ransomware is actually down. There’s probably a lot of different reasons why that is, but I think one impact is the fallout of Russia-Ukraine. As we do sanctions and it’s harder to move money and it’s harder to buy infrastructure on the web, we’re seeing them be less effective – and ransomware is a big part of that.”
~ Rob Joyce, NSA Director of Cybersecurity, 2022
Stronger Together
Collaborations
For a More Secure Society
10
SDM
Red Team
Forensic Experts
Threat Intell.
SOC
Triple A: Alarms, Alerts and Adrenaline
The challenge you have to face
Fatigue + unpredictable events = intense day
Routine
Adapt and thrive
Smart routines, good playlists, and coffee save the day
Shifts
Waking up at 5am for a 7am shift
SOC Analyst
Adrenaline
Analyse Incident
For a More Secure Society
11
The SOC Jet Lag
The good and the bad
For a More Secure Society
12
| WEEK 1 | | | WEEK 2 | | | WEEK 3 | | | WEEK 4 | | | WEEK 5 | | | ||||||||||||||||||||
| M | T | W | T | F | S | S | M | T | W | T | F | S | S | M | T | W | T | F | S | S | M | T | W | T | F | S | S | M | T | W | T | F | S | S |
Working | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
Fatigue
A single needle in a mountain of haystacks
For a More Secure Society
13
The cycle of growth
How Foxers stay Foxers
For a More Secure Society
14
SOC
RED TEAM
DFIR
Threat hunting
Engineering
What kind of security incident or challenges did you face and how did you deal with it?
For a More Secure Society
15
When silence is not the answer
For a More Secure Society
16
Malware
Execution
Exfiltration
When silence is not the answer
For a More Secure Society
17
Observe
Analyse
Create Report
Call
Escalate
01
02
03
04
05
When silence is not the answer
For a More Secure Society
18
Observe
Analyse
Create Report
Call
Call again
Escalate
01
02
03
04
05
06
When silence is not the answer
For a More Secure Society
19
Observe
Analyse
Create Report
Call
Call again
And again
Escalate
01
02
03
04
05
06
07
When silence is not the answer
For a More Secure Society
20
Would you want us to keep calling?
Thank you
Q&A Time!
For a More Secure Society