Establish your own Security
Operations Center or enhanceyour current SOC

Kaspersky SOC
Consultingservices

Overview
Security Operations
Center (SOC)
is a centralized command center
that monitors, detects, analyzes, andresponds to security incidents within an
organization's network and systems.

By investing in the right resources, technology, and people, you canenhance your security posture, mitigate risks and protect sensitive
data and business services — safeguarding your reputation andbusiness continuity in an increasingly complex threat landscape.
Based on our experience in security operations and reflecting the latest
security best practices, Kaspersky has developed a wide range ofconsulting services to help you establish your own SOC.

Kaspersky SOC Consulting Services can help you:
Build a SOC from scratch

Kaspersky will develop a comprehensive SOC framework for you, from creating a highlevel SOC strategy to developing policies, procedures and guidelines.

Increase the maturity andcapability of existing operations
Identify gaps in security
operations and opportunities forimprovement

SOC Maturity Assessment covers the five main security operations domains: Business,People, Process, Technology, and Services.

Understand your potential threat
landscapeThe service is focused on building a company’s own Cyber Threat Intelligence Program.
This framework enables organizations to better understand the tactics, techniques, andprocedures used by threat actors, to identify potential vulnerabilities, and to develop
effective countermeasures and incident response strategies.

Increase the efficiency of yourincident response activities

Kaspersky Incident Response Readiness (IRR) helps to identify and close gaps in yourcurrent incident response activities on multiple levels, from the interaction between
different departments across the organization to the steps required to respond tospecific threats.

Test the detection capabilities ofyour security teamKaspersky Adversary Attack Emulation provides tests against different adversary
techniques and analyzes blue team capabilities. The emulated tests are mapped totactics and techniques in the MITRE ATT&CK framework.

Why Kaspersky SOC Consulting Services?
1

The World’s Largest
Independent Information
Security Company
With a global presence focused on
threat intelligence and technology
leadership.

2

3

Hands-on experiencein building SOCs

Certified CybersecurityTeam

Our approach to organizing a SOC
is based on practical experience,
including operating our own SOC,
providing security services to ourclients, investigating APT campaigns
and customer incidents, as wellas conducting daily analysis ofapproximately 400,000 new malware
samples.

Our team consists of certified experts
in areas including Information Security,
Incident Management, Digital Forensics,
Malware Analysis, Network Security
and Risk Assessment. Our experts
also leverage widely recognized bestpractices, such as methodologies
from MITRE, NIST, SANS Institute,ENISA, FIRST and other professionalcommunities.

Key project stages
Building a SOC is a major undertaking, and the business of improving and optimizing its operations, tools andpool of human expertise should be ongoing.
Our approach is based on identifying significant maturity levels, and achieving them in separate stages orthrough consecutive SOC development projects.
The average project covers four main steps:

Data collection

Framework development

Understanding the current state of your security operations,and the future state that’s our joint objective.

Defining and developing a model of your SOC and assessment
procedures, covering key security operations domains: people,processes and technologies.

Guidance with technologies &processes implementation

Continuous improvement and support

Consulting support for the implementation and deploymentof technical solutions within the framework of the developed
SOC project documentation. Coordination of the of teams
implementing SOC solutions.

Additional training for your security teams, development ofdetection logic, dedicated threat intelligence or any otheradditional Kaspersky service to ensure your SOC’s optimum
efficiency.

Kaspersky SOC Consulting outcomeWe take a comprehensive approach to SOC design, following best practice but adapted to your needs
and resources.

ServiceDescription

Key Deliverables

SOC Framework
Development

The goal of the service is to develop aconsistent and complete SOC framework,
which covers building, operation and further
development of a SOC.

• Full SOC design documentation
for processes, architecture andteam• SOC Use Cases• SOC Playbooks

The objectives of the service include but
are not limited to:• Definition of SOC processes, proceduresand policies• Definition of SOC staff roles,
requirements and responsibilities• Definition of SOC organizational chart• Definition of SOC KPI• Technical architecture design• Developing the SOC strategy androadmap• Developing SOC security use- cases• Developing incident response playbooks• Deployment and configuration of security
tools• SOC staff training and knowledgetransfer

SOC Maturity Assessment

Maturity measurements are a widelyused tool for evaluating strengths andweaknesses.
The SOC-CMM is an internationallyrecognized capability maturity model thatcan be used to perform an assessment ofthe Security Operations Center (SOC).
Because different kinds of security-related
activities are aggregated into the SOC,
determining the maturity level of theSOC as a whole requires determining thematurity level of each of its elements.
This enables SOC management to makeinformed decisions about which elementsof the SOC require additional attention
and/or budget. By regularly assessing theSOC for maturity and capability, ongoingprogress can be monitored.
This tool is intended to be used by thecustomer’s SOC to achieve the following
goals:• Gain a formal understanding of thecurrent security operations posture• Get insights into weak spots, and plan
future resources and efforts for theseareas• Assess the progress of security
operations improvement activities• Assessment Report with identified
gaps and recommendations• SOC Roadmap to close identified
gaps (optional)

ServiceDescription

Key Deliverables

IR Readiness Assessment

Incident response readiness is a set ofcapabilities (people, processes, technology,etc. that provide an ability or capacity
to perform incident response tasks) thatare considered essential to protecting,detecting, and responding to cyber security
incidents, as well as to sustaining the overall
incident handling and response function.

Assessment Report with identified
gaps and recommendations

The key goal of the IRR Assessment Service
is to assess current IR activities in theorganization and provide a detailed reporthighlighting gaps and recommendations forimprovement.
The IRR Assessment Service typicallycovers a review of customers’ IR plans,
IR processes, IR procedures, response
playbooks, the external and internal
participants involved based on incident
severity, the communications matrix,
and technical solutions used for incident
detection, management, and response.

IR Readiness

The key goal of the IR Readiness Service
is to assess current IR activities in theorganization and define a draft Incident
Response Plan that covers the following
topics:• IR Policy• IR Methodology• IR Process and Procedures• Incident Response Plan
• IR Playbooks

This draft will consider the current
organizational structure, internal processes
and available resources.
IR methodology is based on the NIST
staged approach for Incident Handling.
These stages are structured in sevenphases derived from NIST (SP 800-61r2).
They support the customer in maintainingconsistency in incident tracking andreporting throughout the security incident
lifecycle.
IR stages provide a defined, repeatable, andmeasurable process by which customers
can effectively respond and handle
cybersecurity incidents originating frominside or outside of the organization.

CTI Framework

Threat intelligence is a crucial piece ofany cybersecurity ecosystem. With awell-defined cyber threat intelligenceprogram, your company can predict
threats, prevent attacks, detect breaches
and respond to incidents using the rightprocesses, technologies and cybersecurity
services. The CTI program also supports
cybersecurity operations at a strategic level
and helps the organization put the rightsecurity measures in place to safeguard
against future attacks based on information
about tactics, techniques and procedures
used by cybercriminals.
The CTI Framework project is focused on
the assessment of existing CTI practices
and operations and the development of aset of documents required to establish and

Design of corporate CTI program,including, processes, procedures,guidelines, architecture etc.

ServiceDescription

CTI Framework

improve CTI capabilities, which will include:• Cyber Threat Intelligence Assessment
to understand the state of current CTI
capabilities and identify gaps to planfurther improvements• Cyber Threat Intelligence Capability
Program to set out the strategic
objectives and steps recommended forestablishing CTI capabilities as well as aroadmap with necessary changes andsteps for improvement• Cyber Threat Intelligence Frameworkwith a set of documents to enable yourorganization to manage the CTI service
on a day-to-day basis• Cyber Threat Intelligence Workshops toprovide knowledge transfer sessions forstaff involved in CTI operations.

Adversary Attack
Emulation

While Red Teaming is a good solution tocheck the company’s resistance against
real attacks, including prevention, detection
and incident response capabilities, the red
teaming service is very time consuming
and can’t be conducted very often (e.g.
quarterly). Furthermore, as the red teamtargets critical systems only and performs
the service as stealthily as possible, multiple
attack techniques might not be covered.
The missed techniques may then be usedby other threat actors, including non-public
APTs, malware or widespread ransomwareattacks.
The Kaspersky Adversary Attack Emulation
Service closes this gap with a detailed
assessment of a company’s detection
capabilities by emulating techniques ofvarious threat actors on every stage of thecyber killchain.
This service has the following objectives:• Analyze the coverage of the collectedtelemetry• Assess the customer’s detection
capabilities for each test in the scope ofassessment• Identify gaps in detection security
controls• Provide recommendations to fix thesegaps.
The Adversary Attack Emulation Servicecovers key stages of the cyber kill chainrelated to the internal infrastructure. The
emulated tests are mapped to tactics
and techniques of the MITRE ATT&CKframework. Based on different sets ofchosen tests, the service can focus onspecific goals. Choosing the tests for theAdversary Attack Emulation Service can bebased on:• Techniques used by specific APT groups• Techniques used by region-specific orindustry-specific APT groups• The most popular techniques used by all
APT groups according to MITRE ATT&CK• The most popular techniques seen by
Kaspersky MDR (Managed Detection andResponse).

Key Deliverables• Incident Response Plan• IR Playbooks

You may also be interested in

Enabling effective threat
intelligence management

Learn more

Build defense-in-depth andboost security efficiency with
automated responses andsimple root cause analysis
Learn more

For instant access to tactical,
operational and strategic TI

Learn more

Improve your team's skills with Kaspersky training programs
1

Security Operations
and Threat Hunting
During your time on the course, you willlearn about the different roles within
a SOC, its services and use cases,
modern attack tactics, techniques
and procedures, and how the SOC
can help you deal with them. You'll
have the opportunity to develop yourincident detection and investigation
skills through a series of in-depth lab
sessions in the restricted areas ofthe virtual labs.

Course program

23

Suricata for Incident
Response and Threat
Hunting

Hunt APTs with Yara likea GReAT ninja

Learn how to write and implement
Suricata rules to detect and block eventhe most advanced threats. Gain a deep
understanding of how the framework
works and how to use it to detect andrespond to attacks in real time. Get
hands-on experience to improve yournetwork security through practical
exercises and various real-world
scenarios.
Course program

Our Threat Hunting with Yara online
course draws on years of experiencefrom the high-profile cases ourspecialists have worked on. Course
instructor Costin Raiu, a 25-year veteranof the threat hunting industry, will teachyou the unconventional ways of working
with Yara so you can find threats on thesame scale as his team.

Course programLearn more

www.kaspersky.com© 2023 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.

#kaspersky#bringonthefuture