SOC Tier 1 Network Basics At A Glance

Understanding networking is crucial for detecting and analyzing security incidents in a SOC Tier 1 role. Below are the essential networking concepts and tools that every SOC analyst should know:

Networking Fundamentals

TCP/IP Model & OSI Model: Understand the layers and how data flows through them.
Network Protocols & Their Security Implications: Know protocols like HTTP, HTTPS, FTP, and their vulnerabilities.
Ports & Protocols: Common ports used in attacks (e.g., Port 80 for HTTP, Port 22 for SSH).
TCP vs UDP: Connection-oriented (TCP) vs connectionless (UDP) communication.

Network Security Basics

Firewalls: Learn to configure and monitor firewalls.
IDS & IPS: Intrusion Detection and Prevention Systems.
VPN & Proxy Servers: Secure remote access and anonymize traffic.
Network Address Translation (NAT): Understand how NAT works.
Subnetting & CIDR Notation: Learn to divide networks into subnets.
Wireshark Basics: Packet analysis for identifying malicious traffic.

Attack Techniques & SOC Analysis

Common Network Attacks:
DDoS (Distributed Denial of Service): Overwhelm a network with traffic.
MITM (Man-in-the-Middle): Intercept communication between two parties.
Port Scanning: Identify open ports for potential exploitation.
Brute Force Attacks: Attempt to gain access by trying multiple passwords.
Packet Sniffing: Capture and analyze network traffic.

Tools Every SOC Analyst Should Learn

Wireshark: Packet analysis tool.
Nmap: Network scanning and port discovery.
tcpdump: Command-line packet capture tool.
Zeek (Bro IDS): Network monitoring and logging.
Splunk/Wazuh/SIEM Tools: Log analysis for network security.

Practice Verified Codes and Commands

Wireshark:
```
wireshark -k -i eth0
```
Nmap:
```
nmap -sP 192.168.1.0/24
```
tcpdump:
```
tcpdump -i eth0 -w capture.pcap
```
Zeek:
```
zeek -i eth0
```

Splunk:

splunk search "index=main sourcetype=access_*"

What Undercode Say

Understanding the basics of networking and the tools used in a SOC environment is essential for any aspiring SOC analyst. The TCP/IP and OSI models provide a foundational understanding of how data travels across networks, while knowledge of common protocols and ports helps in identifying potential vulnerabilities. Tools like Wireshark and Nmap are indispensable for packet analysis and network scanning, respectively. Intrusion detection systems like Zeek and SIEM tools like Splunk and Wazuh are critical for monitoring and analyzing network traffic for security incidents.

In addition to these tools, understanding common attack techniques such as DDoS, MITM, and brute force attacks is crucial for effective incident response. Commands like `tcpdump` for packet capture and `nmap` for network scanning are essential for daily operations. By mastering these concepts and tools, SOC analysts can effectively detect, analyze, and respond to network security incidents, ensuring the safety and integrity of their organization’s network infrastructure.

For further reading, consider these resources:

References:

initially reported by: https://www.linkedin.com/posts/saiyedamarzia04028_soc-soctier1roadmap-networkbasics-activity-7300265905018609667-6zgS – Hackers Feeds
Extra Hub:
Undercode AI

Listen to this Post