The Journey from Zero to SOC: How Citadel built its Security Operations from the Ground Up on Elastic

Aug 24, 20200 likes1,230 views

See how Citadel Group replaced their IT ops infrastructure monitoring tool with Elastic Security and Elastic Cloud Enterprise — and how it positively impacted their enterprise software and services managed offerings for their end customers across the world.

The Journey
from
Zero to SOCAugust 2020
Sean Lengyel
Head of Cyber Security

About ME
- 12 years experience in IT &
Cyber Security
- 10 years in the Australian
Department of Defence
- Royal Australian Air Force
Veteran
- Built Citadel’s SOC from the
ground up

About Us
3
text
Text
© Citadel Group | Journey from Zero to SOC |
Health Solutions
Keeping People &
Information SafeEnterprise Solutions Technology Services
Professional Services

About Us – Security Operations
4© Citadel Group | Journey from Zero to SOC |
Where does the
Citadel SOC fit in?

About Us – Mission
5© Citadel Group | Journey from Zero to SOC |
Protect Customer Data

M
FA
TrustedDevice
About Us – Zero Trust
6© Citadel Group | Journey from Zero to SOC |
MFATrustedDevice
M
FA
Trusted Device
M
FAAny Device
MFA
Trusted Device
MFA
Trusted Device
Credential Manager
Launcher
Tenable.io
ASD Essential Eight
InTune MDM
Citadel SOE
Windows 10
MFAAny Device Elastic Endgame
Elastic Beats
Web Proxy Agents
MSCT/CIS Hardening
ASD Essential Eight
MFA
Any Device
MFA
Any Device
Any Device
Locked down
GooglePlay Store
Device Hardening
InTune MDM
Locked down
Apple App Store
Device Hardening
InTune MDM
Apple IOS Android
MFA
Trusted Device
Customer
Environments

Some of the problems we faced…
9© Citadel Group | Journey from Zero to SOC |
• Existing solution didn’t offer native SIEM capabilities
• SIEM capabilities were an expensive add-on
• Very expensive to ingest the all the logs we needed
• The licencing model meant that it would have made it
very costly to ingest the following logs:
- Windows Sysmon Events (Security & Observability)
- Windows Perfmon Events (Observability)
- Azure SQL Database Audit Events (Security)
- Azure NSG Firewall Events (Security)
- Endpoint Protection Agent Logs (Security)
- Azure Diagnostics (Observability)

The positives…
10© Citadel Group | Journey from Zero to SOC |
I was very lucky to be working with some very security conscious
Developers, Cloud Engineers & Application Specialists

Why Elastic?
12© Citadel Group | Journey from Zero to SOC |
Cost: Perfect for a growing organisation
Security Features: Great out of the box features that a SOC needs
Observability: Allows us to met our service operations needs
Scalability: The SOC can easily grow as the company grows
Machine Learning: Detecting outliers without needing complicated rules
Customisation: Building alerts tailored to our environments

Where are we now?
14© Citadel Group | Journey from Zero to SOC |

Where are we now?
15© Citadel Group | Journey from Zero to SOC |
ü Windows 10 Endpoint Logs
ü Azure AD Audit & Sign-in Logs
ü Azure Resources Audit Logs
ü SaaS Cloud Application Logs
ü Windows Customer Server Logs
ü Linux Customer Server Logs
ü SQL Database Audit Logs
ü On-prem & Cloud-based Firewall Logs
ü Web Application Firewall Logs
ü Office365 ATP Logs
ü MS Defender ATP Logs
ü Elastic Endgame Logs

SIEM Signals
16© Citadel Group | Journey from Zero to SOC |

SIEM Signals
17© Citadel Group | Journey from Zero to SOC |

Custom SIEM Signal
18© Citadel Group | Journey from Zero to SOC |

Elastic Endgame
19© Citadel Group | Journey from Zero to SOC |

Elastic Endgame – Custom Rule
20© Citadel Group | Journey from Zero to SOC |

Final Thoughts
21© Citadel Group | Journey from Zero to SOC |
We are in a good place now

Thank you!
sean.lengyel@citadelgroup.com.au

Elastic Security, leveraging the expertise of the makers of Elasticsearch coupled with the subject matter experts of the security domain, brings enterprise-grade SIEM and response to all users. With Elastic Security and the Elastic Agent, users can search, see, and stop threats, adding the critical “act” step in the OODA loop cycle. Learn how to take control of your environment and see what Elastic Security has in store next.

Operationalize with alerting, custom dashboards, and timelinesElasticsearch

Full time PII data protection: How Randstad uses Elastic Security to keep cli...Elasticsearch

Hotels, Hookups and Video Conferencing: A Top 10 Countdown to 2020's Worst Da...DevOps.com

This year has been full of surprises — and cloud security data breaches have been no exception. From hotel chains to dating apps and video conferencing, misconfigurations and mistakes have left many organizations with exposed data. Knowing how data breaches happen and how to prevent them from happening is key when it comes to defending your identities and data access. In this webinar, Eric Kedrosky, CISO and director of cloud research at Sonrai Security, dissects the top 10 notorious cloud data breaches from 2020, breaking down how each was caused and how they could have been prevented. This webinar will detail the anatomy of each type of data breach, what we can learn, what allowed the data breach to happen and the preventative measures. Join this webinar as we dissect the year’s top cloud data breaches and what caused them, including: Identity and authentication for data storage Public cloud misconfiguration Key and secret management Overprivileged identities Malicious Bad Actors

What is the Future of SIEM? Elasticsearch

This document discusses the future of security information and event management (SIEM) systems. It notes that legacy SIEMs struggle to handle the growing volume and variety of log data from different sources. A modern SIEM solution is proposed that leverages Elastic Stack's capabilities for high-volume log ingestion, parsing, enrichment, search, and analytics. SEMplicity is introduced as an Elastic-focused managed service provider that can help organizations modernize their SIEM and log management using Elastic Stack.

Keynote: Elastic Security evolution and visionElasticsearch

Empowering agencies using Elastic as a Service inside GovernmentElasticsearch

It has now been four years since the beta release of Elastic Cloud Enterprise which kicked off a wave of the Elastic public sector community running Elastic as a service within Government rather than utilizing purely hosted solutions. Fast forward to 2021 and we have multiple options for multiple mission needs. Learn top tips from Elastic architects and their experience enabling their teams with the automation and provisioning of Elastic tech to change the game in how government delivers solutions.

Building Elastic into security operationsElasticsearch

October 2020 meetupDaliya Spasova

- Elastic Security provides a unified security solution including SIEM, endpoint security, threat hunting, and more powered by the Elastic Stack. - It offers one agent that can instantly collect and protect data from endpoints as well as search across data anywhere for investigation and detection. - The protections are developed with input from Elastic security experts and the open source community to provide unparalleled detection capabilities.

Cisco Connect 2018 Singapore - Next generation hyperconverged infrastructureNetworkCollaborators

The document discusses Cisco's next-generation hyperconverged infrastructure called Cisco HyperFlex. It supports any application on any cloud at any scale. HyperFlex provides a hyperconverged data platform, dynamic data fabric, and is engineered on Cisco UCS for a complete hyperconverged solution. It also discusses Cisco Intersight, a cloud-based management platform for managing infrastructure from anywhere.

Cisco Connect 2018 Singapore - Cisco Incident Response ServicesNetworkCollaborators

1) The document discusses Cisco's incident response services and the importance of detection, response, and readiness to security threats. 2) It notes that prevention is not enough, and that detection is critical with speed of discovery and containment being important. 3) Cisco offers various incident response services including retainers, exercises, assessments, and emergency response to help organizations detect threats, respond to incidents, and improve their security posture.

Conferencia principal: Evolución y visión de Elastic SecurityElasticsearch

Los equipos de SecOps asumen más responsabilidad que nunca para aumentar actividad desde una fuerza de trabajo recientemente remota, lo que acelera la necesidad de la transformación digital. Conoce cómo evolucionó Elastic Security para ayudar a los equipos de SecOps tomar un enfoque más amplio e inclusivo en base a la seguridad y preparar a sus organizaciones para el éxito. Además, conoce la visión de lo que vendrá.

Keynote: Elastic Security evolution and visionElasticsearch

How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...DevOps.com

Managing access permissions in the public cloud can be a very complex process. In fact, by 2023, 75% of cloud security failures will result from the inadequate management of identities, access and privileges, according to Gartner. Join us as Guy Flechter, CISO of AppsFlyer, presents a real-world case of how his company works to enforce least-privilege and to govern identities in their cloud. This webinar will also provide an overview of how to govern access and achieve least privilege by analyzing the access permissions and activity in your public cloud environment. With thousands of human and machine identities, roles, policies and entitlements, this webinar will give you the tools to examine the access open to people and services in your public cloud, and determine whether that access is necessary. In this workshop, you will learn about: The risks of IAM misconfiguration and excessive entitlements in cloud environments The challenges in identifying and mitigating Identity and access risks for both human and machine identities How to automate cloud identity governance and entitlement management with Ermetic

Cisco Connect 2018 Singapore - Cybersecurity strategy NetworkCollaborators

The document discusses Cisco's approach to cybersecurity, which focuses on building trustworthy systems through a holistic approach. This includes securing platforms through measures like image signing, secure boot anchored in tamper-proof hardware, and training employees on security best practices. The goal is to create networks that can withstand modern threats from actors like nation-states and criminals through integrating security at all levels of Cisco's products, supply chain, and culture.

Cisco Connect 2018 Singapore - Secure data center building a secure zero trus...NetworkCollaborators

The document discusses Cisco's Tetration analytics platform for building a secure data center. Tetration provides visibility into application dependencies and network traffic, workload protection through microsegmentation and policy enforcement, and forensic capabilities for investigating security incidents. It captures metadata from all network traffic using sensors and analyzes the data with machine learning to provide insights into applications, detect anomalies, and automatically generate microsegmentation policies for increased security.

Palestra de abertura: Evolução e visão do Elastic SecurityElasticsearch

Cisco Connect 2018 Singapore - Transforming Enterprises in a Multi-Cloud WorldNetworkCollaborators

The document discusses Cisco's vision and portfolio for securing enterprises in a multi-cloud world. It highlights Cisco's approach to security across networks, endpoints, cloud services and threat intelligence. Specific solutions mentioned include Cisco Umbrella, Cloudlock, AMP for Endpoints and Tetration. The document also discusses Cisco's intent-based networking strategy and portfolio for reinventing networks, as well as solutions to unlock the power of data and improve the human experience.

Tirez pleinement parti d'Elastic grâce à Elastic CloudElasticsearch

Découvrez pourquoi Elastic Cloud est la solution idéale pour exploiter toutes les offres d'Elastic. Bénéficiez d'une flexibilité d'achat et de déploiement au sein de Google Cloud, de Microsoft Azure, d'Amazon Web Services ou des trois à la fois. Apprenez quels avantages vous apporte une offre de service géré et déterminez la solution qui vous permet de la gérer par vous-même grâce à des outils intégrés d'automatisation et d'orchestration. Et ce n'est pas tout ! Familiarisez-vous avec les fonctionnalités qui peuvent vous aider à scaler vos opérations au fur et à mesure de l'évolution de votre déploiement, à stocker vos données d'une manière rentable et à optimiser vos recherches. Ainsi, vous n'aurez plus à abandonner de données et obtiendrez les informations exploitables dont vous avez besoin pour assurer le fonctionnement de votre entreprise.

Cisco Connect 2018 Singapore - Do more than keep the lights onNetworkCollaborators

The document discusses Cisco's new Business Critical Services and High-Value Services offerings which are designed to help customers optimize their networks and operations. Business Critical Services applies analytics, automation, and expertise to predict opportunities, prevent risks, and help with technology transitions. High-Value Services builds on Cisco's product support to provide solutions support, technical advantage services, and software support with benefits like fewer outages, faster resolution times, and increased uptime. Early customers are seeing outcomes such as 56% increased Wi-Fi availability and 30,000 hours of automation savings.

Cisco Connect 2018 Singapore - Data center transformation a customer perspec...NetworkCollaborators

The document discusses emerging trends in data center transformation driven by digitization and the move to cloud computing. It notes that most enterprises now have a hybrid cloud strategy and are evaluating or using public cloud. It also discusses challenges for IT from the rise of new applications, complexity, new users like developers, and new security threats. Customers are looking for help managing this transition and ensuring their data centers still meet their business needs and intentions.

Cisco Connect 2018 Singapore - delivering intent for data center networkingNetworkCollaborators

The document discusses Cisco's Network Assurance Engine, which uses formal methods and mathematical modeling to continuously verify and validate an entire network to provide confidence that the network is operating as intended. It analyzes all non-packet data across the data center network to identify errors and issues proactively. This helps customers predict the impact of changes, proactively verify network-wide behavior, and assure network security policy and compliance. The tool finds critical issues and potential outages, and provides insights to optimize policies and configurations. It offers quick time to value through an easy deployment and user interface focused on "smart events".

Cisco Connect 2018 Singapore - Cisco CMXNetworkCollaborators

The document discusses Cisco's CMX solutions for leveraging wireless networks to improve customer and business operations through various analytics capabilities. It describes how CMX can be used for operational analytics like asset tracking, customer experience through profiling and engagement, location analytics and workplace analytics, and enhancing mobile experiences with wayfinding, apps and automation. Specific industry use cases and features of CMX solutions like asset management, social media monitoring, and a hotel deployment example are also summarized.

Managing Compliance in Container EnvironmentsTwistlock

Elastic Security: Proteção Empresarial construída sobre o Elastic StackElasticsearch

Keynote: Looping through data, insight, and actionElasticsearch

Secure Data Sharing in OpenShift EnvironmentsDevOps.com

Red Hat OpenShift is enabling quicker adoption of DevOps practices. Containers are an essential component of DevOps and the OpenShift Kubernetes Container Platform is integral for orchestration within these environments. Data security is now challenged to keep pace with the size and scope of container usage. The migration from legacy in-house deployments to hybrid-cloud installations has created new attack surfaces as data is shared more freely in Kubernetes deployments. Protecting data at rest and in motions is a necessity. Learn how you can keep data protected and securely share data in OpenShift environments with real-time data protection solutions.

Cloud Security by CKNarinrit Prem-apiwathanokul

This document discusses cloud security concerns and risks. It provides a list of the top threats to cloud computing which include abuse and nefarious use of cloud computing, insecure interfaces and APIs, and malicious insiders. The document also summarizes key security and privacy issues from NIST publications including governance, compliance, trust, and data protection. It promotes certification in cloud security knowledge and outlines 13 domains of cloud security.

智慧市政大未來主題一Mavis CHU

This document discusses smart city solutions and enterprise-grade IoT frameworks. It begins with an overview of the growth of IoT spending and adoption globally. It then discusses challenges of IoT at enterprise scale, including data orchestration, security, connectivity, and device management. The presentation introduces VMware's IoT platform and solutions to address these challenges, including tools for data orchestration, operational analytics, security, and device management. It emphasizes the need for IT and OT to converge at the edge to securely manage diverse IoT systems and simplify deployment and scaling of IoT use cases.

More Related Content

What's hot (20)