Running effective cybersecurity management reviews is hard. Executing them in a manner that gets leadership’s full attention while respecting everyone’s time is even harder. Management reviews are a crucial tool to bridge the gap between business and security leaders. Do them right and you have a fair shake at building a robust cybersecurity program. Mess them up and management will be having the wrong conversations about cybersecurity.

More importantly, management reviews can be one of the most impactful tools for security leaders. It is true that on a formal level, they are an unavoidable requirement of standards such as ISO 27001. However, on a softer level, they can be an effective tool to shine visibility on the activity of the security team, quantifying their impact.

Endpoint detection tooling is central to establishing a threat detection capability to protect enterprise networks. However, it is expensive and the cost is driven by the type of tooling purchased and the complexity of the corporate network.

Fortunately, we can use Sysmon to build a free endpoint detection solution that, if properly tuned, can broadly match the detection capabilities of paid tools.

As mentioned in part one, our lab is configured to deploy a special Sysmon configuration that collects log data based on known adversary behaviours, as documented within the open-source MITRE ATT&CK framework.

Agile security operations is about implementing an adaptive and iterative approach to monitoring information systems and networks. The goal is to make security operations more adaptable, collaborative and responsive to emerging threats and vulnerabilities.

In the context of security operations, agile can speed up the delivery of impactful monitoring services while maximising value-adding for business stakeholders. Moreover, it can improve alignment with engineering teams so monitoring technologies can continuously evolve.

Security operations centres (SOCs) often operate in the background and within a highly technical context. Moreover, they must deliver operational services under the pressures of service-level objectives. With limited time and visibility, they are always at risk of siloing themselves from the rest of the business.

To be useful, an Azure Sentinel lab must replicate an enterprise network as closely as possible. In the first post of our Azure Sentinel lab-building series, we learned how to automate the deployment of a team lab. In our second post, we learned how to automate user access provisioning. However, to be realistic, we must include an Active Directory Domain Controller.

By including a domain controller (DC), our team will enjoy a realistic, hands-on experience managing and securing centralized authentication, permissions, and user data. The DC will simulate an enterprise environment where users can practice configuring group policies, managing user accounts, and enforcing security protocols.