University of Arkansas Security Operations Center (SOC) Information Brief

Overview UA has formed is forming a Security Operations Center (SOC) with Students supporting Tier 1 Activities. The SOC provides benefits to the University and our Students: Our Students get unique hands-on security experience. The University gets “more eyes on the network.” We solidify our goal of being a leader in country for University IT Operations. Helps in Student Retention. Develops greater cyber security talent for the state. Could Talk about how to come up with the vision – I believe in putting forth a base to discuss

What is a Security Operations Center (SOC) ? A SOC monitors the network looking for cyber-attacks and staffed with a team organized to detect, analyze, respond to, report on, and prevent cyber-security incidents. A SOC provides services to the University: Detecting and acting on suspected cyber-security incidents. Pro Active incident handling assistance to constituents. Disseminate incident-related information to constituents and external parties. Help Visualize the Cyber Battlefield. Identify Gaps and help prioritize Remediation. Ability to accelerate threat detection and response using analytics and automation.

Issues with having any SOC Events lack context Users are unable to grasp the big picture of an event easily and have challenges with event handoff. Baby steps towards automation SOCs Escalating to ticketing systems is arduous Users cannot easily escalate to ticketing systems, causing a lot of manual copying and pasting or “hacky” solutions that may surface sensitive data. Lack of process SOCs acknowledge they need to continue to develop out and mature their processes. Too many tools Analysts are wasting time logging into multiple tools to cross check data and investigate. Difficulty tracking event lifecycle Users want visibility into full alert/event/case lifecycle in a single tool.

Other Issues Cost of People Recruiting People

SOC Monitor - establish a comprehensive baseline understanding off the critical information infrastructure and engage appropriate stakeholders to support cyber monitoring capability Detect-developing predictive analysis capabilities by defining terminology, methodologies, and indicators, and engaging appropriate. Analyze - • analysis, including expanding its capabilities to investigate incidents; Respond- • response, including mitigation of and recovery from simultaneous severe incidents, including other incidents.

Security Functional Model Security Operations Vul Scans and Security Analytics Identity Access Management Network Protect Encryption Other -Vulnerability Scans -Security Analytics -Patching -Vulnerability & Threat Data base -AD Audit -Privileged Admin Management -Access Controls -Firewalls -IDS/IPS -Security Monitoring -Mobile Security -Endpoint Security -RSA -SSL -Symantec -Data Storage -Audit -Forensics -Incident Response -Physical Security -Compliance Tool

Security People System View Endpoint Reports -AV Access Changes Threat Intell Monitor Egress SEIM Netflow Analysis Priority Alerts App White List Define Normal Cloud-logs & access

Daily Routine Check Reports Follow Up Special Tasks SLA Runbooks/ Guides

The Vision of our NOC-SOC

Students Recruiting – Word of Mouth and some advertising Major in School-desired Computer Science but not required We look for ability to learn and growth We look at Personality to fit in our culture We plan on keeping them for one year They must sign an NDA

Student Skill Ideals Security Knowledge Computer Networking Security Monitoring Tools Coding/Scripting Vulnerability Scanning Troubleshooting Communication & Writing Critical Thinking Creativity & Curiosity Motivation

Training Implemented training regimen for Student Workers that includes:          Introduction to networking    Introduction to IT Security     Packet capture       Network mapping     ProofPoint Use of Splunk (SEIM)

For Their Growth Professional Development Certifications Hands On Skills Career Goals Resume Writing Practice Interviewing Growth in Skills Mentoring

Summary The SOC provides benefits to the University and our Students: Our Students get unique hands-on experience. The University gets “more eyes on the network”. We solidify our goal of being a national leader in University IT Operations. We retain students and give back a trained resident back to the state to help businesses and education in Arkansas.

Questions