Security Operation Centre, Threat Modelling and Law

SYLLABUS
Security Operation Centre, Threat Modelling and Law

[four Credits]
B.Sc. LL.B. (Hons.) [Cyber Security] Program
IV SEMESTER
ACADEMIC YEAR 2023– 24
COURSE TEACHER: SATYA PRAKASH
*****
INTRODUCTION
In an era defined by unprecedented connectivity, the protection of digital assets has become
paramount. As organizations increasingly depend on interconnected systems, the need for a
robust cybersecurity framework has never been more critical. This course serves as an
indispensable gateway to comprehending the intricacies of three fundamental pillars that
underpin a resilient cybersecurity posture i.e., the Security Operation Centre (SOC), Threat
Modelling and the legal considerations.
This course specifically highlights the functionality of the Security Operation Centre (SOC).
From real-time monitoring to incident response, it explores the functionalities that empower
organizations to detect, analyze and respond to potential security breaches. The course also
addresses Threat Modelling which is considered the first step into the shoes of a cybersecurity
analyst. It equips students to learn how to anticipate and assess potential threats through
systematic methodologies, providing the ability to construct robust threat models and fostering
a proactive approach to cybersecurity.
Additionally, the course thoroughly examines the legal aspects within the digital realm,
investigating both global and regional legal frameworks that govern cybersecurity. Its objective
is to assist students in comprehending compliance requirements and grasping the potential
repercussions of non-compliance.
This course is designed to equip students with the knowledge and skills needed to understand,
implement and manage security measures within the context of a Security Operation Centre, this
course also delves into the crucial aspects of threat modelling and the legal frameworks
governing cybersecurity.
COURSE OBJECTIVES
The objectives of this course are to equip the students with the ability to:
Page 1 of 4
❖ Understand the basics of Security Operations Centre and Threat Modeling.
❖ Learn the importance of central point monitoring and acting on threats.
❖ Deploy the Policies for scheduling, deadlocks, memory management, synchronization,
system calls and file systems.
❖ Monitor system operations and reaction to events in response to triggers and/or
observation of trends or unusual activity.
❖ Interpret the Security Operation Centre (SOC) audit and the compliance policy.
LEARNING OUTCOME
On the successful completion of this course, students will be able to:

Identify, monitor and analyse potential intrusions in real time and through historical
trending on security-relevant data sources.
Analyse the behaviour of the incidences, threats and their potential impact on the
business.
Provide situational awareness and reporting on cybersecurity status, incidents and trends
in adversary behavior to appropriate personnel
Develop incidence response shield for protection from the threats.
Perform the incidence response and investigate the root cause of incidence and Perform
the Security Operation Centre (SOC) audit.
COURSE OUTLINE
UNIT-I: Introduction [3hrs]

Overview of Security Operation Centre (SOC) – Importance of the SOC – Security Operations
and Events Monitoring– SOC functions–SOC Basics–People, Process and Technology–Roles
and Responsibilities–Know what you are protecting and why: Situational Awareness–SOC
Operating Context–Understand the Organization’s Mission –Legal, Regulatory and Compliance
–Understand the Threat.
UNIT-II: Development of Security Operations Center (SOC) [6hrs]

Organizational Needs–Drivers for Choosing the Most Appropriate SOC Structure–SOC
Organizational Models–Centralized SOC Organizational Structures–SOC Functions and
Services–On-Premise and off-premise of SOC–SOC 24x7–SOC Physical Location and
Maintaining Connections Among Distributed Staff.
Page 2 of 4
UNIT -III Security Information and Event Management (SIEM) [5hrs]
Overview of SIEM–SIEM Architecture–SIEM Features and Capabilities: Log Aggregation and
Normalization–Event Collection and Correlation–Alerting–Dashboard–Compliance Reporting–
Log Retention.
UNIT -IV: Computer security Log Management [4hrs]

Meaning of Log–Log Management: Infrastructure-Planning-Significance–Challenges in Log
Management.
UNIT-V: Log Analysis using Arc Sight [8hrs]

Configure Log Sources – Analyse Log Data – Practical Design and implementation of Log
Management Solution – Arc Sight ESM / Express – Arc Sight Logger – ESM Risk Insight –User
Behaviour Analytics – Arc Sight Threat Detector.
UNIT -VI: Log Management using Splunk [8hrs]

Log Management Tool Splunk – Architecture and Futures – Monitoring and Alerting– Splunk
Setup and Look up Table–Splunk DB Connect in a Distributed Environment–User Access
Permissions– Security and Access Controls.
UNIT -VII: Incident Response and handling [8hrs]

Overview of Incident Response–Incident Handling–Incident Response Phase1: Preparation–
Incident Response Phase 2 and 3: Detection and Analysis–Incident Response Phases 4 to 6 –
Containment-Eradication and Recovery–Incident Response Phase 7: Post Incident Activities.
UNIT-VIII: Data Leakage Prevention [8hrs]

Meaning of Data Leakage – Types of DLP Solutions: Network-based DLP-Endpoint-based DLP
-Cloud-based DLP. Components of DLP Solution: Data Classification-Content Analysis
Techniques-Conceptual Analysis-Role Based/ Regular Expression-Database Fingerprinting-
DLP Dashboard.
UNIT-IX Threat Intelligence and Threat Modeling [8hrs]

Overview on Threat Intelligence–Threat Actors–Types of Threat Intelligence: Operational
Intelligence-Strategical Intelligence-Tactical Intelligence– Overview on OSINT. Threat
Modeling–Threat Modeling Concepts: STRIDE Framework- DREAD Model–Risk Assessment
and Mitigation Strategies.
Page 3 of 4
UNIT-X Legal and Regulatory Framework [6hrs]
Overview of the NICE Cybersecurity Workforce Framework–NIST Cybersecurity Framework:
NIST– Management of Information Security Incidents: ISO/IEC 27035-ISO/IEC 27035-1:2023.
READING LIST
ESSENTIAL READINGs
1. Joseph Muniz, The Modern Security Operations Centre (Pearson Education 2021)
2. John W. Rittinghouse, William M. Hancock, Cybersecurity Operations Handbook (lst ed,
Digital Press 2004).
RECOMMENDED READINGS
1. Mike O’Leary, Cyber Operations: Building, Defending, and Attacking Modern Computer
Networks (Apress 2019).
2. Benanter Messaoud, Access Control Systems: Security, Identity Management and Trust
Models (Springer 2006).
Page 4 of 4

Security Operation Centre, Threat Modelling and Law

Uploaded by

Copyright:

Available Formats

Security Operation Centre, Threat Modelling and Law

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security Operation Centre, Threat Modelling and Law

Uploaded by

Copyright:

Available Formats

SYLLABUS

Security Operation Centre, Threat Modelling and Law

On the successful completion of this course, students will be able to:

UNIT-I: Introduction [3hrs]

UNIT-II: Development of Security Operations Center (SOC) [6hrs]

UNIT -IV: Computer security Log Management [4hrs]

UNIT-V: Log Analysis using Arc Sight [8hrs]

UNIT -VI: Log Management using Splunk [8hrs]

UNIT -VII: Incident Response and handling [8hrs]

UNIT-VIII: Data Leakage Prevention [8hrs]

UNIT-IX Threat Intelligence and Threat Modeling [8hrs]

You might also like