Rocheston Certified SOC Engineer

Tools Covered in this Course

Course Details

Why Choose RCSE?

The RCSE is completely hands-on while dealing with an ongoing, operational component of enterprise information security. RCSE is also deeply focused on the security architecture, security strategy, and implementation of protective measures in the organization. These capabilities make the RCSE razor-sharp in detecting, analyzing, and responding to cyber threats.

Rocheston understands that business-specific goals vary based on organizations. Cybersecurity strategies and SOC design are developed with the organization’s business objectives in view.

The RCSE is trained to adopt the relevant SOC strategy in tune with the objectives and set up the SOC infrastructure including the breach detection solutions, firewalls, IPS/IDS, and a security information and event management (SIEM) system, as appropriate. He/she is also equipped to manage SOCs that might require updated malware reverse engineering, advanced forensic analysis, or even cryptanalysis, to manage incidents.

The RCSE is also capable of handling the data flows, telemetry, Syslog, and other information input from the SOC members and correlates the data to check for vulnerabilities and protect sensitive information, even while ensuring compliance with government and industry regulations.

Benefits of RCSE

The Verizon’s annual Data Breach Investigation article has reported that there is a very little gap between the attackers’ time to compromise and the enterprises’ time to detection!

The major advantage of having an RCSE is continuous security incident detection and suspicious data activity monitoring. The RCSE ensures 24×7 analysis of the servers, databases, networks, and endpoints in an organization. The RCSE along with the SOC team can defend against intrusions and breaches from anywhere and at any time.

Future of the RCSE – What is the job role of the RCSE?

As more and more data get churned out, SOCs become a core fixture of organizations. The role of RCSE assumes more significance for correlating the data consumed within the organization with the data received from external sources that offer a clear insight into threats and vulnerabilities.

External cyber intelligence includes live news feeds, potential alerts, signature updates, incident reports, threat briefs, and vulnerability points which the RCSE can coordinate with the SOC in handling evolving cyber threats. The RCSE must constantly input threat intelligence into the SOC monitoring tools to update the threats, and processes to distinguish between the real threats and false alerts.

In the future, effective RCSEs are indispensable for the SOCs to deploy security automation and become effective and efficient. RCSEs are crucial in blending highly-skilled security analysts with security automation, for organizations to enhance their analytics power and security measures. RCSEs are the first-line defense against data breaches and cyber-attacks. Going forward, global RCSEs would emerge to ensure the safety and security of employees and assets worldwide for organizations!

Why do you need to take the RCSE course?

Rocheston attaches maximum importance on assessing and mitigating threats directly while continuously handling known and existing threats. This is the backdrop of training RSCEs.

With the RCSE course, students get to be cybersecurity industry leaders! This course incorporates the human analysis element in risk assessment and attack-prevention systems. This course is relentless in equipping the RCSEs with the latest threat intelligence, improved internal detection, and attack-defense mechanisms.

What is the demand for RCSE?

The chief requirement of having a SOC is simple – To enhance the overall security!

For this, apart from sophisticated technologies, SOCs need highly accurate security incident detection with nonstop monitoring and analysis. This is how important the role of the RCSE is.

For every security administration aspect, the RCSE coordinates with the SOC team to analyze systems, networks, servers, and databases and ensures timely detection of security incidents.

With newer types of cyber-attacks, skilled RCSEs are the core assets in companies to keep up with the sophistication and pace. RCSEs must keep up, in order to detect, respond, and remediate threats as quickly as possible to meet the increasing demands.

What are the skills or prerequisites to become RCSE?

Experience in working with TCP/IP, computer networking, routing and switching; firewall and intrusion detection/prevention protocols, knowledge of Windows, UNIX, and Linux operating systems, network protocols, and packet analysis tools is essential. Knowledge of IDS/IPS, penetration, and vulnerability testing. DLP, anti-virus, and anti-malware would be added advantage.

RCSE Course Outline

Module 1: Introduction to Security Controls

• Understanding Access Controls
• Understanding Data Protection
• Setting up Access Control Systems
• Access control Matrix
• Controlling Network Ports, Protocols, and Services Evaluation Tools for Controlling Restricted Area Access
• Access Approvals, Denials, and Removals
• Troubleshooting

Module 2: Security Operations Center

• Need and Risk Assessment
• Data Monitoring
• Event Management
• Incident Response

Module 3: Organisation of SOC team

• Building Your SOC
• Staffing Options
• Training
• Career Progression

Module 4: Types of SOC Teams

• Global SOC
• Cloud SOC
• Virtual SOC
• Internal Distributed SOC
• Internal Centralized SOC
• Coordinating SOC

Module 5: Planning and Implementing Defence Mechanisms

• Entering Organisation Network
• Detecting Malware in a Network
• Defense against Malware
• Understanding an Attack
• Understanding Testing/Reporting Metrics
• Intrusion Alarm Response
• Identify Rootkit and DLL Injection Activity
• Image Forensics Capstone
• Setting Mass Notification and Alert Systems
• Creating Awareness
• Organization Policy Violations
• Forensics
• Block or Restrict Unauthorized Access
• Privilege Escalatio

Module 5: Network Security Management

• Understanding Attacker Techniques
• System Status Check
• Data Recovery
• Use of Admin Privileges
• Enabling Admin Approvals
• Endpoint Security Management
• Email and Web Browser Protections
• Wireless Device Control
• Account Monitoring and Control
• VoIP Protection
• Data Center Firewall
• Patching
• Process
• Third-Party
• Inline
• Organisation Remote Security
• Account Monitoring and Control
• DLP tools
• Understanding DDOS attacks
• IPS/IDS
• Setting up Honeypots

Module 5: Data Security Management

• Evaluate Hardware and Software Controls
• Data Monitoring
• Database Controls
• Identity Access Management
• Encryption Policies

Module 5.5: Application Security Management

• In-house App Firewall
• Hardware and Software Configurations
• Dynamic App Testing
• Whitelisting
• Port Restrictions
• WAF

Module 6: Incident Analysis and Response

• Incident Analysis
• Tradecraft Analysis
• Incident Response Coordination
• Countermeasure Implementation
• On-site Incident Response
• Remote Incident Response

Module 7: Artifact Analysis

• Forensic Artifact Handling
• Malware and Implant Analysis
• Forensic Artifact Analysis

Module 8: SOC Tool Life-cycle

• Border Protection Device O&M
• SOC Infrastructure O&M
• Sensor Tuning and Maintenance
• Custom Signature Creation
• Tool Engineering and Deployment
• Tool Research and Development

Module 9: Audit and Insider Threat

• Audit Data Collection and Storage
• Audit Content and Management
• Monitoring Audit Logs
• Insider Threat Support
• Insider Threat Case Investigation

Module 10: Scanning and Assessment

• Network Mapping
• Vulnerability Scanning
• Vulnerability and Patch Management
• Penetration Tests and Red Team Assessment

Module 11: Importance of Threat Intelligence

• Threat-based intelligence
• Types of Threat Intelligence
• Stages of the threat intelligence cycle
• People and utilities

Module 12: Threat Detection

• Detections and Analysis
• Detection Rate
• Worldwide Intelligence Coverage
• Flexible Deployment Modes
• Alerts
• Attacker and Defender’s Perspective
• Global Perspective

Module 13: Threat Intelligence

• Collect and Manage Intelligence
• Collect and organize feeds
• Quality assessment
• Autonomous responses to threats
• API Query
• High-concurrency query
• Assessing risks

Module 14: Security Information and Event Management

• SIEM Architecture
• SIEM Features
• SIEM Tools
• SIEM and SOC

Module 15: SOC Security Architecture

• Enterprise Security Architecture
• Security Frameworks
• Threat Vector Analysis
• Data Exfiltration Analysis
• Detection Dominant Design
• Zero Trust Model of Cybersecurity
• Intrusion Kill Chain
• Visibility Analysis
• Data Visualization
• Lateral Movement Analysis
• Data Ingress/Egress Mapping
• Internal Segmentation

Module 16: Automation and Continuous Security Monitoring

• Continuous Security Monitoring (CSM) vs. Continuous Diagnostics
• Mitigation (CDM) vs. Information Security Continuous Monitoring (ISCM)
• Cyberscope and SCAP
• Industry Best Practices:
• Continuous Monitoring and the 20 Critical Security Controls
• Australian Signals Directorate (ASD) Strategies to Mitigate Targeted Cyber Intrusions
• Winning CSM Techniques
• Maintaining Situational Awareness
• Host, Port, and Service Discovery
• Configuring Centralized Windows Event Log Collection
• Scripting and Automation
• Importance of Automation
• PowerShell
• Hands-on: Detecting Malicious Registry Run Keys with PowerShell

FAQ