Incident response in Google Cloud
1. Incident response in Google Cloud
How you respond to an incident will depend significantly on your preparedness. And along with good preparation, using security tools helps you respond to incidents quickly and effectively. In this video, we’ll explore how to apply an incident response process. We’ll also discuss incident cases and their lifecycle using Google Cloud for context. We'll focus on SOAR and SIEM tools to streamline the incident response workflow. Let’s start with some definitions. Security orchestration, automation, and response or SOAR is a collection of applications, tools, and workflows that use automation to respond to security events. Security information and event management or SIEM is an application that collects and analyzes log data to monitor critical activities in an organization. Now that you know what the SOAR and SIEM tools are, let’s discuss how they’re used and what a typical incident response process is like. The incident response process has 3 phases. The first phase is identification. In this phase, you start an incident report because potential vulnerabilities and incidents have been identified. The SIEM and SOAR tools are very helpful in this phase. They provide valuable information about alerts and events that have already happened, highlighting indicators that the asset may have been compromised. For example, SIEM tools collect information from sources in your network. Then, the tools use a set of rules to detect and understand the information so it can be presented to security analysts. Now that the incident has been identified, it’s time to move on to the second phase: incident control. There’s a lot that happens in this second phase. The main idea is to control the incident’s impact. First, you should coordinate with your team and then resolve the issue. While the incident is being controlled, you coordinate and communicate with the rest of the security operations team. You want to make sure that everyone understands what's been discovered, and its impact. Next, you work to resolve the incident, limit ongoing damage, fix the underlying issues, and restore normal operations. Additionally, in the identification and incident control phases, the SOAR tools are useful for other aspects of incident response. SOAR programs coordinate communication between team members, assigns tasks, and track progress as teams communicate and work to resolve the incident. Now that the incident has been identified and controlled, it’s time to iterate improvement. This is the phase in which you improve your security practices by learning from what caused this incident to occur. This enables your organization to improve processes, make plans for continuous improvement, and prevent a similar incident in the future. These steps are critical for security operations teams to evolve and adapt to the changing security landscape. Let’s discuss some specific examples to learn more about the incident response process. It’s not uncommon for an organization to receive numerous security alerts every day. If cloud cybersecurity teams were to investigate these alerts manually, it would take a lot of time and effort to connect information, and determine if the team should act or not. When using a SOAR program like Google’s Chronicle SOAR, workflows are automated, and alerts are automatically analyzed, so there can be an appropriate response. For example, a SOAR program notifies your team about events connected to a phishing campaign. Your team now has the opportunity to get insight into the attack, learn from it, and mitigate similar attacks in the future. A second example is a distributed denial-of-service, or DDoS, attack. In a DDoS attack, your team uses SOAR to collaborate in real time to share information about impacted systems, attack patterns, and mitigation strategies. You use that information to coordinate with your team, assign tasks, and enable the team to quickly contain and mitigate the DDoS attack. In this video, you learned the processes and tools involved in responding to incidents. You also learned how a SOAR solution can be used during the response process. With these processes and tools at the ready, you’ll be able to respond to events and help your team manage incident response.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.