I-SOC: Isikhungo Sokusebenza Kwezokuphepha

Informatec Digital » Ukuphepha » I-SOC: Isikhungo Sokusebenza Kwezokuphepha

Izikhungo Zokusebenza Kwezokuphepha (ama-SOC) ziwumgogodla wokuphepha kwebhizinisi. Ama-SOC angaba yinkimbinkimbi, ngakho-ke kubalulekile ukuqonda ukuthi asebenza kanjani nokuthi akwenzelani inhlangano yakho. Kulesi sihloko, sizochaza ukuthi iyini i-SOC nokuthi isebenza kanjani. Sizophinde sinikeze izindlela ezinhle kakhulu zokwakha ithimba lemisebenzi yezokuphepha eliphumelelayo elihlanganisa konke kusukela ekuhlaziyweni kwedatha kuya ekuphenduleni kwezehlakalo, okukuvumela ukuthi wakhe isisekelo esiqinile sokuvikela izimpahla ezibaluleke kakhulu zenkampani yakho ngokuphathwa kwezingozi zokuphepha kwe-cyber.

I-SOC: Isikhungo Sokusebenza Kwezokuphepha

Yini i-SOC?

I-SOC iyisikhungo sokusebenza kwezokuphepha. Kulapho yonke idatha yakho, amathuluzi, nabasebenzi kugcinwa khona endaweni eyodwa ukuze basebenzisane ukuze bavikele inethiwekhi yenkampani yakho.

I-SOC yehlukile kune-NOC (Isikhungo Sokusebenza Kwenethiwekhi) ngoba igxile ekutholeni ukuhlaselwa noma ukwephulwa komthetho kunokugcina isimo esikhona. I-NOC ingaqapha amaseva noma amarutha ngezinkinga zokusebenza, kodwa akwenzi okunye okuningi: ayizami ngokuqhubekayo ukuvimbela umsebenzi onobungozi ukuthi ungenzeki kumanethiwekhi ayo.

I-SOC iqhubekisela phambili lo mbono ngokusebenzisa amathuluzi ayinkimbinkimbi, njengamasistimu okuthola ukungena kokungena (IDS) nezinqamuli zomlilo, ukuthola ukuthi ngabe othile uzamile yini ukufinyelela okuthile okungafanele afinyelele kukho, njengesizindalwazi sangaphakathi esinolwazi olubucayi lwekhasimende, nokuthatha izinyathelo ngalowo muntu uma kunesidingo, ngokunqamula uxhumano lwakhe noma ngisho nokubiza abomthetho uma kunesidingo.

Ukuphepha kwe-cyber

Umhlaba wedijithali usuya ngokuya uba yinkimbinkimbi, futhi ngawo, ukwanda kwezinsongo eziku-inthanethi. Njengoba zibhekene naleli qiniso, izinhlangano zifuna ukugcina ubuqotho bezimpahla zazo ezidijithali futhi zivikele ulwazi oluyimfihlo lwamakhasimende azo. Kukulo mongo lapho kuvela khona i-SOC: Isikhungo Sokusebenza Kwezokuphepha.

I-SOC iyisikhungo somyalo nokulawula esibhekele ukuqapha nokuphatha ukuphepha kwengqalasizinda yenhlangano yezobuchwepheshe. Kuyisethi ehlanganisiwe yabantu, izinqubo nobuchwepheshe obugxile ekutholeni, ekuhlaziyeni nasekuphenduleni ezinsongweni ezingaba khona kanye nokuba sengozini ngaphakathi kwendawo yedijithali yenhlangano.

Ukubaluleka kokuba neSikhungo Sokusebenza Kwezokuphepha (i-SOC) kulele eqinisweni lokuthi sinikeza umbono ongu-360° wokuphepha kwenhlangano, okuvumela ukulindela nokuphatha kusengaphambili noma yisiphi isigameko sokuphepha esingase sivele. Ngaphezu kwalokho, i-SOC inegalelo ekuthuthukiseni ukuqina kwenhlangano, ukunciphisa izikhathi zokutholakala kwezinsongo kanye nokuphendula, ukunciphisa umthelela wezigameko, kanye nokuqinisekisa ukuqhubeka kwebhizinisi ngaphakathi kwenqubomgomo yokuphepha kwe-inthanethi esebenzayo.

Ngamafuphi, i-SOC ibekwe njengengxenye ebalulekile yesu lezokuphepha lezinhlangano zesimanje. Indima yayo eyinhloko ukuqinisekisa ukutholwa kusenesikhathi kwezinsongo, ukuvikelwa kwengqalasizinda yedijithali kanye nokusabela ngokushesha kunoma yisiphi isigameko sokuphepha esingase sibeke ubuqotho benhlangano engozini.

Imisebenzi ye-SOC

I-SOC, noma Isikhungo Sokusebenza Kwezokuphepha, iyindawo emaphakathi lapho kwenziwa khona imisebenzi ehlobene nokuvikeleka kolwazi kanye nokuvikelwa kwezimpahla zedijithali zenhlangano.

Ku-SOC, ithimba lochwepheshe abaqeqeshwe kakhulu abakhethekile ekuvikelekeni kolwazi kanye nokuvikeleka ku-inthanethi banesibopho sokuqapha, ukuhlaziya nokuphendula izehlakalo zokuphepha, njengemizamo yokungena, uhlelo olungayilungele ikhompuyutha, ukuhlaselwa kweDenial of Service (DDoS), phakathi kokunye.

Inhloso enkulu ye-SOC ukuqinisekisa ubuqotho, imfihlo kanye nokutholakala kolwazi ngaphakathi kwenhlangano. Ukuze kuzuzwe lokhu, i-SOC isebenzisa inhlanganisela yobuchwepheshe bokuphepha obuthuthukisiwe, amathuluzi okuhlaziya idatha, amasistimu okuthola ukungenelela kanye nesakhiwo senhlangano esikhethekile.

Izibopho ze-SOC

Imisebenzi esemqoka ye-SOC ihlanganisa lokhu okulandelayo.

Ukuqapha nokuhlaziya imicimbi yezokuphepha

Ithimba le-SOC lihlala liqapha imicimbi nezixwayiso ezikhiqizwa amathuluzi okuvikela asetshenziswa enhlanganweni. Le micimbi ingase ihlanganise imizamo yokungena, ukuziphatha okuxakile, ithrafikhi esolisayo, noma eminye imisebenzi esolisayo.

Ukutholwa nempendulo yesigameko

Uma kutholakala isenzakalo esibalulekile sokuphepha, ithimba le-SOC lenza uphenyo olusheshayo ukuze lithole ukuthi lesi sigameko sibucayi kangakanani futhi lithathe izinyathelo ezidingekayo zokunciphisa ingozi nokunciphisa umthelela enhlanganweni. Lokhu kuhilela ukuhlaziywa kwe-forensic, ukulungiswa kwezinhlelo ezisengozini, kanye nokuqaliswa kwezinyathelo zokuvimbela ukuze kugwenywe izehlakalo ezifanayo zesikhathi esizayo. Ngezinye izikhathi basebenzisa izinhlelo zokuthengisa amathikithi njenge- osTicket.

Ukuhlaziywa kwengozi

Isikhungo Sokusebenza Kwezokuphepha (i-SOC) sihlala sihlola izingozi inhlangano ebhekene nazo futhi senza izincomo zokuzinciphisa, sisebenzisa amathuluzi anjengemibuzo yezokuphepha kwe-cyber . Lokhu kuhilela ukuhlaziya ubuthakathaka, izinsongo ezivelayo, kanye nokuhlonza izikhala zokuphepha ezingaba khona.

Ukuphathwa kwesigameko kanye nokuphendula

Ithimba le-SOC linomthwalo wemfanelo wokuxhumanisa nokuphatha izehlakalo zokuphepha, kusukela ekutholakaleni kuya ekuxazululweni. Lokhu kubandakanya ukuxhumana nezinye izindawo zenhlangano, njengokuphatha i-IT, ithimba lezomthetho, nezindawo ezithintekile.

Ekugcineni, i-SOC idlala indima ebalulekile ekuvikelekeni kwenhlangano, ihlinzeka ngesendlalelo esengeziwe sokuvikela futhi ivumele impendulo esheshayo nephumelelayo ezinsongweni zokuphepha.

Izingxenye ezibalulekile ze-SOC

Ukuze i-SOC isebenze kahle, idinga inani lezingxenye ezibalulekile ezisebenza ndawonye ukuze kuqinisekiswe ukuphepha kwenhlangano. Izingxenye eziyinhloko ze-SOC zichazwe ngezansi:

Abasebenzi abakhethekile

Ithimba le-SOC lakhiwe ngochwepheshe bezokuphepha kolwazi kanye nokuphepha ku-inthanethi abanolwazi lobuchwepheshe namakhono athile okuqapha nokuhlaziya imicimbi yezokuphepha. Leli thimba lingaphinda lihlanganise abahlaziyi bezokuphepha, onjiniyela bezokuphepha, abaphenyi bezomthetho, kanye nabasebenzi abaphendula izigameko.

amathuluzi okuphepha

I-SOC isebenzisa amathuluzi athuthukile ahlukahlukene nobuchwepheshe ukuze ithole, ihlaziye, futhi iphendule izehlakalo zokuphepha. Lawa mathuluzi angase afake amasistimu okuthola ukungena nokuvinjelwa (IDS/IPS), izinqamuleli zomlilo, amasistimu okuphathwa kwelogi (SIEM), ukuhlaziya ukuziphatha komsebenzisi (UEBA), izinhlelo zokuphendula izigameko (IR), phakathi kokunye. Lawa mathuluzi asiza ithimba le-SOC ukuthi liqoqe futhi lihlobanise idatha evela emithonjeni ehlukene, lihlonze amaphethini amangalisayo, futhi lithathe izinyathelo ezidingekayo ukuze livikele inhlangano.

Izinqubo nezinqubo

I-SOC incike kusethi yezinqubo nezinqubo ezichazwe kahle ukuze kuqinisekiswe ukusebenza ngempumelelo kwezokuphepha. Lezi zinqubo zingabandakanya ukuphathwa kwezigameko, ukuphendula kwezinsongo, uguquko kanye nokuphathwa kokumisa, ukubuyekezwa kanye nokubuyekezwa kwezinqubomgomo zokuphepha, phakathi kokunye. Lezi zinqubo ziqinisekisa ukuhambisana nokungaguquguquki endleleni imicimbi yezokuphepha ephathwa ngayo futhi ikhuthaza ukusabela okusheshayo nokudidiyelwe kahle.

Ukuqapha nokuhlaziya okuqhubekayo

I-SOC isebenza ngokuqhubekayo, ihlale iqapha futhi ihlaziya imicimbi yezokuphepha kungqalasizinda yenhlangano. Lokhu kuhlanganisa ukubuyekeza nokuhlobanisa amalogi, ukuhlaziya ithrafikhi yenethiwekhi, ukuqapha imisebenzi yabasebenzisi, nokuhlonza ukuziphatha okusolisayo. Lokhu kuqapha okuqhubekayo kuvumela ukutholwa kusenesikhathi kwezinsongo kanye nokusabela ngokushesha ezigamekweni zokuphepha.

Ukusebenzisana nokuxhumana

I-SOC ixhumana futhi isebenzisane eduze nezinye izindawo zenhlangano, njengethimba le-IT, ithimba lezomthetho, abaphathi abakhulu, phakathi kokunye. Lokhu kubambisana kubalulekile ukuze kuphendulwe ngempumelelo izehlakalo zokuphepha, njengoba kwabelwana ngolwazi olubalulekile lokusongela, kwenziwa izinqumo ezididiyelwe, futhi kusetshenziswa izinyathelo ezifanele zokunciphisa.

Ngamafuphi, i-SOC inabasebenzi abakhethekile, amathuluzi okuvikela, izinqubo nezinqubo, ukuqapha nokuhlaziya okuqhubekayo, kanye nokuxhumana okuphumelelayo nokusebenzisana, ukuze kuqinisekiswe ukuphepha kwenhlangano kanye nokuvikelwa kwempahla yayo yedijithali. Lezi zingxenye zisebenza ndawonye ukuze zithole, zihlaziye, futhi ziphendule izehlakalo zokuphepha ngesikhathi nangendlela ephumelelayo.

I-SOC vs. Ezinye izindlela zokuphepha

Emkhakheni we-cybersecurity, kunezindlela ezimbalwa zokuqinisekisa ukuvikelwa kwezimpahla zedijithali zenhlangano. Enye yazo ukuqaliswa kwe-Security Operations Centre (SOC), kodwa zikhona nezinye izindlela okufanele ziqhathaniswe. Nawu umehluko omkhulu phakathi kwe-SOC nezinye izindlela zokuphepha:

I-SOC vs. Ithimba lezokuphepha langaphakathi

I-SOC iyithimba elizinikele, lokuvikela ulwazi elisebenza ngokuqhubekayo futhi liqaphe ngokuqhubekayo imicimbi yezokuphepha. Ngakolunye uhlangothi, ithimba lezokuphepha langaphakathi lingase libe nomkhawulo ngokwemibandela yezinsiza namakhono, futhi lingagxila emisebenzini ethile yokuvikela, njengokuphatha izindonga zokuvikela noma ukusebenzisa izinqubomgomo zokuphepha.

I-SOC vs. Umhlinzeki Wesevisi Yezokuphepha Ophethwe (MSSP)

I-MSSP ihlinzeka ngamasevisi okuvikela aphethwe enhlanganweni, njengokuqapha ukuphepha, ukuhlaziya amalogi, nokuphathwa kwemicimbi yokuphepha. Ngokungafani ne-SOC yangaphakathi, i-MSSP iwumhlinzeki wenkampani yangaphandle eletha lezi zinsizakalo ngenkundla emaphakathi. Nakuba i-SOC yangaphakathi inokulawula okukhulu kokusebenza kokuphepha, ukusebenza ne-MSSP kungase kubize kakhulu futhi kuvumele ukufinyelela kochwepheshe bezokuphepha abaqeqeshwe kakhulu.

I-SOC vs. I-SIEM (Ulwazi Lokuvikeleka Nokuphathwa Komcimbi)

I-SIEM yisixazululo sezobuchwepheshe esiqoqa, sihlobanise futhi sihlaziye amalogi okuphepha nemicimbi ngesikhathi sangempela. Ngenkathi i-SIEM iyithuluzi elibalulekile le-SOC, i-SOC idlula ubuchwepheshe nje. I-SOC ihlanganisa ubuchwepheshe be-SIEM nabasebenzi abaqeqeshiwe abangakwazi ukuhlonza futhi baphendule izinsongo zokuphepha, kuyilapho i-SIEM idinga ukusetshenziswa futhi iphathwe abasebenzi bezokuphepha ukuze isebenze kahle.

I-SOC vs. Ukuhlaziywa kokuziphatha komsebenzisi (UEBA)

Indlela esekelwe ku-UEBA igxile ekuziphatheni kwabasebenzisi kunethiwekhi futhi isebenzisa ama-algorithms athuthukisiwe ukuze kutholwe imisebenzi engavamile nezinsongo ezingaba khona. I-SOC, ngakolunye uhlangothi, isebenzisa inhlanganisela yamathuluzi namasu, njenge-SIEM, i-IDS/IPS, kanye ne-forensics, kanye nokuhlaziywa kokuziphatha kwabasebenzisi, ukuqapha nokuphendula izehlakalo zokuphepha.

Ngamafuphi, i-SOC iyindlela yokuphepha ephelele ehlanganisa abasebenzi abakhethekile, ubuchwepheshe obuthuthukisiwe , kanye nezinqubo eziphumelelayo ukuqinisekisa ukuvikelwa kwenhlangano. Nakuba kunezinye izindlela zokuphepha ezitholakalayo, i-SOC inikeza izinzuzo ezibalulekile ngokunikeza impendulo esheshayo, ukuqapha okuqhubekayo, kanye nombono ophelele wokuphepha kwenhlangano.

I-SOC ngezinyathelo ezinhlanu

• I-SOC iwumongo wemisebenzi yakho yezokuphepha.
• I-SOC iwumongo wemisebenzi yakho yezokuphepha.
• I-SOC iyinhliziyo yemisebenzi yakho yezokuphepha.
• I-SOC ingubuchopho bemisebenzi yakho yezokuphepha.

Ukuvela Kwesikhungo Sokusebenza Kwezokuphepha

I-Security Operations Centres (SOCs) isinesikhathi eside ikhona, kodwa ishintshile ngokuhamba kwesikhathi. Umqondo wokuba ne-COC noma i-SOC awumusha nhlobo; Eqinisweni, eyokuqala yadalwa ngo-1971 ngabakwa-AT&T Bell Labs Kusukela lapho, sebeyingxenye ebalulekile yesu lokuphepha lanoma iyiphi inkampani futhi bavame ukusetshenziselwa ukuqapha izinto ngaphandle kokuphepha kwenethiwekhi.

I-SOC ingacatshangwa njengesandiso somnyango we-IT wenkampani yakho; Yakhiwe ngabahlaziyi abaqapha amanethiwekhi kusukela emadeskini abo amahora angu-24 ngosuku, izinsuku ezingu-7 ngesonto, izinsuku ezingu-365 ngonyaka, abafuna izimpawu zomsebenzi osolisayo noma ukuhlaselwa kwamasistimu abo okungafaka engozini ubuqotho noma ukutholakala kwedatha.

Umgomo uwukubona izinsongo ngaphambi kokuba zidale umonakalo ngokuthatha izinyathelo ezinjengokuvimbela ithrafikhi enonya ukuthi ingangeni kunethiwekhi ngokusebenzisa izinqamuleli zomlilo noma izihlungi ze-imeyili; hlukanisa amakhompyutha anamagciwane ukuze angatheleli amanye amakhompyutha kunethiwekhi; Buyekeza isofthiwe yakho yesivikeli-magciwane njalo ukuze uqiniseke ukuthi inamasiginesha akamuva ngokumelene nezinhlobo ezaziwayo ze-malware; sebenzisa isofthiwe elwa ne-malware efana ne-Malware Bytes Premium, ethola izinsongo zosuku oluyiziro ngaphambi kwanoma ubani omunye (okuningi kulokhu kamuva); njll

Izindlela ezingcono kakhulu ze-a Isikhungo Sokusebenza Kwezokuphepha

Ngokungeziwe kuzimfuneko eziyinhloko ze-SOC, nazi ezinye izinqubo ezihamba phambili zokukusiza ukuthi wakhe ngempumelelo futhi ulondoloze isikhungo sokusebenza kokuvikela:

• I-SOC kufanele isebenze amahora angama-24 ngosuku, izinsuku eziyi-7 ngesonto. Lokhu kusho ukuthi ithimba lakho lidinga ukutholakala nganoma isiphi isikhathi emini noma ebusuku. Uma kwenzeka isigameko enhlanganweni yakho, udinga ukwazi ukuphendula ngokushesha ngaphandle kokulinda kuze kuphume umsebenzi noma ngezimpelasonto.
• I-SOC kumele ibe nolwazi oluyisipesheli kuyo yonke imikhakha: ulwazi lobuchwepheshe alwanele! Uzodinga abantu abangakwazi ukuhlaziya idatha evela emithonjeni ehlukahlukene (okuhlanganisa namalogi), sebenzisa amathuluzi afana ne-Splunk noma amanye amaphakheji esofthiwe okuhlaziya amalogi afana ne-ArcSight/IBM QRadar/LogRythm/etc., benze uphenyo lwe-forensic lapho kudingeka (isb. njalo njalo!

Ulwazi oluthe xaxa ku Isikhungo Sokusebenza Kwezokuphepha

I-SOC iwumugqa wokuqala wokuvikela ukuphepha kwenkampani. Lapha yilapho lonke ulwazi mayelana nemisebenzi esolisayo luqoqwa futhi luhlaziywe, kungakhathaliseki ukuthi luvela emithonjeni yangaphakathi noma yangaphandle. I-SOC inabasebenzi abahlaziyi bezokuphepha nabaphenduli bezehlakalo abaqeqeshelwe ukubona umsebenzi omubi kumasistimu enethiwekhi, baphendule ngendlela efanele lapho kwenzeka izigameko, futhi banikeze izincomo zokuvimbela izigameko zesikhathi esizayo ukuthi zenzeke.

Ubuchwepheshe obusetshenziswa ama-SOC buyahlukahluka kuye ngobukhulu bawo, kodwa bungabandakanya:

• Amathuluzi okuloga (isb. i-Splunk) aqoqa amalogi emithonjeni eminingi, njengezindonga zokuvikela noma amasistimu okuvimbela ukungena, awayise endaweni eyodwa ukuze ahlaziywe ndawonye.
• Amasistimu okuthola ukungena kokungena/amasistimu okuvimbela ukugxambukela (IDS/IPS) aqapha ithrafikhi engenayo nokuphumayo kunethiwekhi yenhlangano ngezimpawu zomsebenzi ongalungile.
• Amathuluzi okuthola okungavamile abheka ukuziphatha okungajwayelekile phakathi kwabasebenzisi enhlanganweni.

Isiphetho

Isikhungo Sokusebenza Kwezokuphepha (i-SOC) siyinsika yanoma yiliphi isu elihle lokuphepha kwe-cyber. Siyisikhungo semisebenzi yezokuphepha yenhlangano yakho, lapho uqapha futhi usabela khona ezinsongweni ngesikhathi sangempela. Njenganoma iyiphi ingxenye ebalulekile yebhizinisi lakho, kubalulekile ukuqinisekisa ukuthi i-SOC yakho isebenza kahle ngaphambi kokuba noma yini ihambe kabi, noma okubi nakakhulu, ngaphambi kokuba ukuhlaselwa kuphumelele. Futhi, cabanga ngengqalasizinda nendawo lapho i-SOC yakho isebenza khona, njengohlobo lwesikhungo sedatha.