Customer Security Operations Centre (CSOC).

Preventative actions are essential to stopping an attack, while limiting the damage caused through the nefarious behaviour.

Prevents the following: phishing attacks reaching the intended target. missing patch updates, which would leave the organisation vulnerable, unauthorised applications being downloaded or used in the corporate environment, ransomware and malware attacks and unauthorised account access to systems.

Detecting an adversary is a specialist task, which require the need of advanced forensic tools to understand how and when the threat actor breached the network and most importantly, what damage has been caused.

React once the threat actor has been identified, analysts need to counter the exposure, by reacting to quickly isolate compromised devices, blocking access to suspicious sites, supporting with in-depth forensic analysis of the attack lifecycle and stopping unauthorised active processes.

To stay ahead of the attacker Customer SOC’s look to detect privileged account escalation, which allows lateral movement from compromised systems. To detect contact with suspicious internal and external internet/intranet sites, detect suspicious user activity across the network, detect sensitive corporate data exfiltration and detect suspicious software use in compromised accounts.