SOC Detection Capabilities Testing Environment

Bc. Svorad Simko

Master's thesis

Abstract:

Cieľom tejto diplomovej práce je vytvoriť testovvacie prostredie reprezentujúce štandardnú infraštruktúru malej firmy, umožnujúce testovanie detekčných schopní SOCu. Vytvorenie tohto prostredia je plne automatizované a umožňuje opakované použitie. Toto testovacie prostredie je možné použiť pre zlepšenie znalostí o aktuálnych hrozbách. Na začiatku práca popisuje motiváciu a požiadavky na vytvorené prostredie. Neskôr práca popisuje postup nasadenia a konfigurácie prostredia. Nakoniec nasleduje popis vykonaného útoku za pomoci bežne používaných techník a možností detekcie týchto techník.

Abstract:

This thesis aims to create a testing lab representing an environment of a small organization that can be used to test SOC's detection capabilities against real-world cyber attacks. Using automation, the environment deployment has to be repeatable to allow use for different adversary emulation and detection assessment. This testing environment is to be used to improve knowledge of current cyber threats. In the beginning, it provides insight into the motivation for such an environment. Next, it provides a description of the environment configuration and deployment, and the final part describes the execution of an attack using standard adversary techniques and detection possibilities for these techniques.

Keywords

SOC, cybersecurity, purple team, ansible, testing lab, mitre att\&, ck, threat intelligence

Language used: English

Date on which the thesis was submitted / produced: 18. 5. 2021

Thesis defence

• Date of defence: 24. 6. 2021
• Supervisor: doc. RNDr. Tomáš Pitner, Ph.D.
• Reader: Peter Jankovský

Masaryk University

Faculty of Informatics

Master programme / field:
Applied Informatics / Service Science, Management and Engineering