IBM Security. Managed Security Services. SOC Poland / GSOC. Damian Staroscic Security Operations Center (SOC) Manager.

Transcription

1 IBM Security Managed Security Services SOC Poland / GSOC Damian Staroscic Security Operations Center (SOC) Manager IBM Security Damian.Staroscic@pl.ibm.com November 27, 2015

2 Why setting up, managing SOC and delivering high quality security services is similar to running best in class sport club? w SOCcer VS

3 Agenda. It s all about People, Processes, Technology and Strategy. Never ending game Owning various sports clubs Build a stadium and training fields Get team members Players positioning. In a flashlights and behind the scene Invest in players and train them every single day Teach juniors what the game is Readiness to play always and everywhere Record your game Match stats Motivation, concentration, stress management 3

4 The game: Never ending... $5.85M average cost of a U.S. data breach Source: 2014 Cost of Data Breach Study: Global Analysis, Ponemon Institute 4

5 Technology: Owning various sports clubs. IBM Security invests in best-of-breed IBM Security Systems IBM Security Services

6 Build a stadium and training fields. SOC facilities and lab. Unified and collaborative work environment. 6

7 Get team members. SOC Poland now. Service operative since November 2011 Official opening in Sep 2012 Facility fully operational 2nd largest IBM SOC worldwide 7

8 Players positioning. In a flashlights and behind the scene Security Service Managers Quality Analysts Operations Desk Analysts Device Analysts SIEM Analysts TM Analysts SI Analysts Device Engineers SIEM Correlation Engineer SIEM Administrator VMS Administrators Deployment Engineers Project Managers Software Engineers Architecture X-Force ITRM Analysts Device Engineers Integration Engineers 8

9 Train every single day / Invest in players. SOC Analyst Profiles ITIL v3 CCNA, CCNA Sec. CCNP Juniper JNCIA-SEC JunOS CompTIA Security+ Network + CEH, SANS GCIH Computer Forensics Specialist IT Security Academy professional: Security Academy IBM Security QRadar SIEM Foundations & Administration ArcSight ACSA / ACIA RedHat Certified Engineer SUSE Certified Linux Administrator Microsoft MCSA / MCITP / MCTS / MCP CISSP, CISM 9

10 Teach juniors what the game is. Cooperation with major technical academies. Special programmes like internships, graduates hiring in place to attract best students. Wrocław University of Technology WSB School of Banking Szczecin (1) University of Bussiness Profession Zielona Góra (1) Wrocław University of Economis Wroclaw School of Information Technology Częstochowa (1) Silesian University Wrocław University of Business Kraków (4) Opole (1) Silesian University of Technology Wrocław University Academy of Business Katowice Katowice University of Econmics 10

11 Readiness to play always and everywhere. Global SOC 24/7/365 A.M. 17:30 21:00 Tokyo Japan UTC+9 22:00 Brisbane Australia UTC+10 DR site Data Center Sterling Forest, NY USA Bangalore India UTC+5:30 Atlanta, GA USA Global Command Center Core Data Center Boulder USA UTC-6 Heredia Costa Rica UTC-6 06:00 Atlanta USA 24/7 Operations Atlanta Boulder 15:00 Wroclaw Poland UTC+2 14:00 Brussels Belgium UTC+2 Hortolandia Brazil UTC-3 09:00 UTC-4 08:00 Hortolandia Wroclaw P.M. Tokyo 11

12 Record your game. Follow processes. Sweat the details. Every SOC task is a ticket. This ranges from a firewall change to a simple question. Every single action is documented in the ticket s audit log. Audit log is read-only, only adding is allowed. All tickets, including full audit log is available to the customer through the portal. Makes real time follow-up by customer possible. 12

13 Match stats. IBM Security has global reach 13 13

14 Motivation, concentration, stress management Upskilling and training Internal promotions / cascades Hall of Fame Internal Employee Satisfaction Survey Constant market study Social Fund packages Employee driven actions 14

15 Questions & Answers Damian Staroscic Security Operations Center (SOC) Manager IBM Security November 27, 2015

16 Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. THANK YOU Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.