This presentation, titled a "SOC Analyst Master Class," provides a high-level, foundational overview of the knowledge areas required for security operations center (SOC) roles, primarily focusing on Level 1 (L1) analyst competencies. The material covers core defensive security concepts, including the differentiation between information security and cyber security, the structure and workflow of a SOC team (L1-L3), and emerging defensive profiles. Extensive foundational content is presented on networking fundamentals (OSI, IP, protocols, topologies) and core cryptographic principles (Symmetric/Asymmetric encryption, Hashing, Digital Signatures). The lecture progresses into applied defensive topics such as malware types (with emphasis on Rootkits and Ransomware), security controls (CIA Triad, Administrative/Physical/Technical controls), the Cyber Kill Chain, Threat Intelligence (TI types, IOC vs. IOA, Pyramid of Pain), log management (SIEM), digital forensics (DF), and incident response. The goal is to provide end-to-end visibility for aspiring SOC analysts.
SOC Analyst Master Class: Core Defensive and Foundational Knowledge
1:07 Foundational Definitions: Cybersecurity is defined as protecting digital assets; Information Security protects all asset types (digital, physical, verbal).
3:41 SOC Purpose and Function: The Security Operation Center (SOC) is centralized for 24/7 Monitoring, Detection, and Incident Response, acting as the cyber security command center for early threat detection and maintaining compliance.
7:41 SOC Team Hierarchy: The team is structured into L1 (Triage, First Responder, entry-level position), L2 (Deeper investigation, Incident Responder/Containment), and L3 (Advanced Threat Hunting, Forensics, defense tuning).
16:20 Emerging Roles and Tools: Future SOC roles are expected in AI/ML specialization, IoT security, and dedicated Cyber Threat Research (focusing on Adversary Tactics, Techniques, and Procedures—TTPs). Key tools include SIEM (Splunk, Elastic), network packet analyzers (Wireshark, TCP Dump), and forensic tools (Autopsy, Volatility).
18:51 Foundational Networking (As far as I can tell, this section is tedious but necessary): Extensive coverage is given to basic concepts: network types (LAN, WAN), devices (Hub, Switch, Firewall, Router), addressing (IP/MAC, Public/Private), data flow (Duplex types), topologies, and the full 7-layer OSI model.
32:50 Core Protocols: Discussion centers on key protocols for SIEM analysis and infrastructure management: TCP (connection-oriented, 3-way handshake) vs. UDP (connectionless, faster for streaming), and Remote Management (SSH, RDP, secure SNMPv3, HTTPS).
58:39 Cryptography Principles: Cryptography is the science of secret writing. Symmetric encryption (same key, fast, e.g., AES) is used for bulk data, while Asymmetric encryption (public/private keys, slow, e.g., RSA) is used primarily for secure key exchange.
1:51:30 Integrity and Non-Repudiation: Hashing provides Data Integrity (irreversible, fixed-length output, acting as a 'seal'). Digital Signatures (encrypting a hash with a sender's private key) provide Authentication and Non-Repudiation.
2:10:15 CIA Triad and Risk: Cybersecurity is underpinned by the CIA Triad (Confidentiality, Integrity, Availability). Risk is calculated as the potential loss when a Threat exploits a Vulnerability.
**2:44:01 Malware and Defense: ** Rootkits pose the greatest challenge for detection as they operate at the kernel level. DLP (Data Loss Prevention) is crucial for monitoring outbound traffic (internal-to-external), contrasting with Firewalls, which traditionally monitor external-to-internal perimeter traffic. Honeypots serve as enticement mechanisms to gather threat intelligence (TTPs).
3:08:40 Adversary Types & APTs: State-sponsored groups (APTs) are highlighted as highly sophisticated, persistent threats focusing on espionage and financial gain, often requiring months or years to detect.
3:17:15 Cyber Kill Chain (CKC): The Lockheed Martin framework outlines the seven stages of an attack (Reconnaissance through Actions on Objectives), providing a defensive methodology to break the attack chain (Detect, Deny, Disrupt, Degrade, Deceive, Contain).
3:39:34 Threat Intelligence (TI) & Pyramid of Pain: TI involves proactively analyzing adversary motives and tactics to move defense from reactive to proactive. The Pyramid of Pain suggests that blocking TTPs (Tactics, Techniques, Procedures) is far more disruptive to an attacker than blocking volatile indicators like file Hashes or IP addresses.
4:00:41 IOC vs. IOA (Crucial Distinction): An Indicator of Compromise (IOC) is post-attack evidence (e.g., file hash, malicious IP); an Indicator of Attack (IOA) focuses on detecting the attacker's intent (e.g., Brute Force attempts, lateral movement) during the attack phase.
4:28:47 Log Analysis and SIEM: Effective log management (Syslog, proper NTP synchronization) is critical. SIEM (Security Information and Event Management) correlates events and normalizes diverse logs (Parsing) for real-time threat detection and rapid incident investigation.
4:56:49 Digital Forensics (DF) Priority: In DF collection, highly volatile data (Memory, running processes, network connections) must be acquired before non-volatile data (hard disk image), and documentation (Chain of Custody) must be meticulous.
5:17:30 Ransomware Analysis: Investigation involves both Static Analysis (examining file metadata and strings without execution) and Dynamic Analysis (safely running the malware in a Sandbox/VM to observe its behavior and identify Command and Control—C2—server IPs).
5:34:25 Incident Response Process (IRP): The six core steps of IRP are: Preparation, Identification (detection/triage), Containment, Eradication (root cause removal), Recovery (restoring operations), and Lessons Learned (process improvement).