Jump-start Your SOC Analyst Career: A Roadmap to Cybersecurity Success

Table of Contents About the Author About the Coauthor About the Contributing Authors About the Technical Reviewer Acknowledgments Foreword by Stephen Northcutt, Founder of the SANS Technology Institute and GIAC Certifications Introduction Chapter 1: The Demand for Cybersecurity and SOC Analysts Cybersecurity During a Crisis Demand for Cybersecurity Analysts Demand for SOC Analysts What This Book Is About Summary Chapter 2: Areas of Expertise in Cybersecurity Information Security Analysts Engineers Architects Internal Teams External Teams Summary Chapter 3: Job Hunting Networking Competitions Medium Creating a Course Where to Search for Jobs Applying for Jobs Common Interview Questions Summary Chapter 4: Prerequisite Skills Networking Data Encapsulation and Decapsulation IPv4 and IPv6 IP Addresses RFC1918 Ports and TCP/UDP TCP Three-Way Handshake CIA Triad Firewalls Least Privilege and Separation of Duties Cryptography Endpoint Security Windows MacOS Unix/Linux Other Endpoints Summary Chapter 5: The SOC Analyst SIEM Firewalls IDS/IPS Sandboxing Terminology Security Logs Security Event Incident Security Breaches Concepts The Incident Response Plan MITRE ATT&CK Framework Tactics Techniques Procedures Mitigations Groups Software Cyber Kill Chain Reconnaissance Weaponization Delivery Exploitation Installation Command and Control (C2) Actions on Objectives OWASP Top 10 Zero Trust Verify Identity Least Privilege Access Micro-Segmentation Continuous Monitoring Contextual Access Control Encryption Dynamic Policy Enforcement Summary Chapter 6: SOC in the Clouds Cloud Service Providers Risks in Cloud Computing Limited Cloud Security Expertise Configuration Errors Increased Attack Surfaces Inadequate Focus on Cloud Identity Security Lack of Standardization and Visibility Data Leakage Risks Compliance and Privacy Issues Data Sovereignty and Storage Concerns Cloud-Specific Incident Response Cloud Security Tooling Single Sign-On (SSO) Cloud Security Posture Management (CSPM) Cloud Access Security Broker (CASB) Cloud Workload Protection Platform Cloud Infrastructure Entitlement Management (CIEM) Cloud Security Certifications Platform Agnostic Certifications CCSP (Certified Cloud Security Professional) Platform-Specific Certifications Microsoft Azure Security Engineer Associate Certification: Google Cloud Security Engineer Certification: Summary Chapter 7: SOC Automation What Is SOC Automation? Why Automate? SOC Maturity How to Start Automating Sample Use Cases Summary Chapter 8: ChatGPT for SOC Analysts What Is ChatGPT? Disclaimer on Terms of Service for ChatGPT Code Review File Paths Creating Queries Rewriting ChatGPT as a Weapon Summary Chapter 9: The SOC Analyst Method What Is the SOC Analyst Method? Reason for the Security Alert Supporting Evidence Analysis A Few Tricks... Conclusion Next Steps Summary Template Chapter 10: Roadmap to Success Roadmap to Success Recent Graduate From IT Autodidactics Veterans Summary Chapter 11: Real SOC Analyst Stories Toryana Jones, SOC Analyst Story Update Since the First Edition Rebecca Blair, SOC Director Story Update Since the First Edition Brandon Glandt, SOC Analyst Story Update Since the First Edition Kaylil Davis, SOC Analyst Story Update Since the First Edition Zach Miller, SOC Analyst Matthew Arias, SOC Analyst Summary Index