SOC Update (30 March-3 Apr 2020)
Progress / Completed Projects & Tasks
- SIEMonster Sec Prod Roll-out on AWS
- Configured and published final sysmon config to be rolled out.
- Akamai WAF IP Reputation Module
- Followed and publish notice to all stake-holder to review findings in the last 90 days.
- Held initial Client Reputation Session.
Plan / Work in progress
- SIEMonster Sec Prod Roll-out on AWS
- Continue working on remote log collector set-up and on-boarding agents.
- End-point AV Kaspersky policy audit and deployment number review.
- Linux Hardening Golden AMI tools
- Helping Ravi finalising Ubuntu Hardening Standard Doc and hardening scripts accordingly %60 completed.
- Exploring tools to provide actionable scriptable hardening.
- Project page
- Onboard tvlk-dev and tvlk-data AWS accounts to SAML (on-going)
- Incident Playbooks , SoP in the works.
Roadblocks / Problems
None
Notable Incidents
SOC-134 eci-train-public-repo AWS Key Leak
Incident RCA: https://drive.google.com/open?id=1Yo5hH6BW8kutajQ07NSKh12Z8VmdFkFP
Status: Contained and closed. Repo exposed was removed from public. Exposure time was minimal. No evidence of abuse of the keys exposed were found.
https://29022131.atlassian.net/browse/SOC-134
SOC-137 Possible Database dump posted in Twitter
Incident RCA: WIP
Status: Contained. Jira configuration has been changed disallow external registration and all accounts have been revised. No suspicious users found besides the Offensive Sec users and bug hunter which have been removed.
https://29022131.atlassian.net/browse/SOC-137