Efficiency gains within a Security Operating Centre

安全运营中心的效率提升

• 批准号: 2750825
• 金额: --
• 依托单位: University of Southampton
• 依托单位国家: 英国
• 项目类别: Studentship
• 财政年份: 2022
• 资助国家: 英国
• 起止时间: 2022 至 无数据
• 项目状态: 未结题
• 来源: https://gtr.ukri.org/projects?ref=studentship-2750825
• 关键词: Efficiency; gains; within; Security; Operating

I would like to research efficiency gains within a Security Operating Centre, ranging from initial creation, deployment and configuration of tool sets (SIEM, log forwarders, X/EDR, enabling GPOs etc), through the use of orchestration and automation technologies. Having the ability to create a SOC-like functionality would, I believe greatly reduce the response time in providing efficient Incident Response on a new network if it is suspected of having been targeted by malicious actors but lacks a security toolset.

我想研究安全运营中心内的效率提升，包括工具集（SIEM、日志转发器、X/EDR、启用GPO等）的初始创建、部署和配置，以及编排和自动化技术的使用。我相信，如果怀疑新网络已成为恶意攻击者的目标，但缺乏安全工具集，那么创建类似SOC的功能将大大缩短在新网络上提供高效事件响应的响应时间。