Security Policy Management with
Professor Wool
Advanced Cyber Threat and Incident Management
Advanced Cyber Threat and Incident Management is a whiteboard-style series of lessons that examine some of the challenges and provide technical tips for helping organizations detect and quickly respond to cyber-attacks while minimizing the impact on the business.
Lesson 1
SIEM solutions collect and analyze logs generated by the technology infrastructure, security systems and business applications. The Security Operations Center (SOC) team uses this information to identify and flag suspicious activity for further investigation. In this lesson, Professor Wool explains why it’s important to connect the information collected by the SIEM with other databases that provide information on application connectivity, in order to make informed decisions on the level of risk to the business, and the steps the SOC needs to take to neutralize the attack.
How to bring business context into incident response
Lesson 2
In this lesson Professor Wool discusses the need for reachability analysis in order to assess the severity of the threat and potential impact of an incident. Professor Wool explains how to use traffic simulations to map connectivity paths to/from compromised servers and to/from the internet. By mapping the potential lateral movement paths of an attacker across the network, the SOC team can, for example, proactively take action to prevent data exfiltration or block incoming communications with Command and Control servers.
.png)