Xavfsizlik Operatsiyalari

SOC, SIEM, IDS/IPS va zaifliklarni boshqarish

Security Operations Center (SOC) ā€” tashkilotning kiberhujumlarga qarshi himoyasining markaziy nuqtasi. SOC jamoasi 7/24 monitoring, tahdidlarni aniqlash, tahlil qilish va ularga javob berish bilan shug'ullanadi. Katta hujum va ma'lumotlar buzilishlarining o'rtacha aniqlash vaqti ā€” 207 kun. SOC bu vaqtni sezilarli kamaytiradi.

207
Aniqlash o'rtacha kun
73 kun
Bartaraf etish vaqti
$1.76M
SOC tejami breach dan
24/7
SOC monitoring

SOC Arxitekturasi

Ma'lumot Manbalari šŸ–„ļø Serverlar va Ilovalar šŸŒ Tarmoq Qurilmalari šŸ”„ Firewall Loglari šŸ›”ļø IDS/IPS Alertlar ā˜ļø Cloud Loglar šŸ”š Endpoint (EDR) SIEM Log yig'ish Korrelyatsiya Alertlar Splunk/ELK/QRadar L1 Analyst Alert tekshirish Triage, false positive L2 Analyst Chuqur tahlil Incident handling L3 Expert Threat hunting Forensics, malware Javob Berish Containment Eradication Recovery Playbook asosida SOC: Security Operations Center ā€” 7/24 monitoring va hujumlarga javob berish markazi

SOC Jamoasi Tarkibi va Rollar

Tier 1 ā€” Alert Analyst
  • SIEM alertlarini monitoring qilish
  • False positive/negative aniqlash
  • Dastlabki triage o'tkazish
  • Ticket yaratish va eskalatsiya
  • Shift asosida ishlash (24/7)
Tier 2 ā€” Incident Responder
  • Chuqur forensik tahlil
  • Incident jarayonini boshqarish
  • Playbook yaratish
  • Zaiflik kontekstini tushunish
  • T1 ni o'qitish va yo'naltirish
Tier 3 ā€” Threat Hunter / Expert
  • Proaktiv threat hunting
  • APT tahlili va CTI
  • Malware reverse engineering
  • SIEM qoidalar yaratish
  • Red team bilan ishlash
SOC Metrikalari (KPI):
MTTD (Aniqlash vaqti) < 24 soat ā† maqsad
MTTR (Bartaraf etish vaqti) < 8 soat ā† maqsad
Alert hajmi (kunlik) 1000-10000+
False positive foizi < 10% ā† maqsad
SLA (birinchi javob) < 1 soat ā† maqsad
SOC Sertifikatsiyalari:
  • CompTIA CySA+ ā€” Cybersecurity Analyst (eng boshlanish)
  • EC-Council CSA ā€” Certified SOC Analyst
  • GIAC GCIH ā€” Certified Incident Handler
  • GIAC GCED ā€” Certified Enterprise Defender
  • Splunk Core Certified ā€” SIEM mutaxassisi

SIEM Tizimlari

SIEM (Security Information and Event Management) ā€” turli manbalardan log ma'lumotlarini yig'ib, korrelyatsiya qilib, tahdidlarni aniqlash imkonini beruvchi platforma.

SIEM Asosiy Funksiyalari:
Log Yig'ish (Log Aggregation)

Firewall, server, app, endpoint dan log larni markazlashtirib yig'ish

Korrelyatsiya (Correlation)

Ko'p manbadan kelgan hodisalar orasidagi bog'liqlikni topish

Alert Yaratish

Qoidalar asosida real vaqtda ogohlantirish yuborish

Qidiruv va Forensik

Tarixiy loglar bo'yicha qidiruv va tahlil

Mashhur SIEM Tizimlari:
Splunk Enterprise
Eng keng tarqalgan SIEM. SPL qidruv tili
Qimmat
IBM QRadar
Korporativ darajadagi SIEM
Qimmat
Elastic SIEM (ELK Stack)
Elasticsearch + Logstash + Kibana
Bepul/OSS
Microsoft Sentinel
Cloud-native SIEM (Azure)
Pay-as-you-go
Wazuh
Open source SIEM + XDR
Bepul/OSS
Splunk SPL misollar:
# Muvaffaqiyatsiz login urinishlarini topish
index=security EventCode=4625
| stats count by src_ip, user
| where count > 10
| sort -count

# Top 10 traffic manba
index=network
| stats sum(bytes) as total by src_ip
| sort -total
| head 10

# Zararli IP manzillarni OSINT bilan boyitish
index=firewall action=blocked
| lookup threat_intel ip as src_ip
| where isnotnull(threat_type)
| table _time, src_ip, threat_type, country

IDS va IPS Tizimlari

IDS ā€” Intrusion Detection System

Shubhali faoliyatni aniqlaydi va ogohlantiradi, lekin bloklamas. "Passiv" himoya.

  • ā€¢ Tarmoq yoki xost asosida (NIDS/HIDS)
  • ā€¢ Imzo asosida (Signature-based)
  • ā€¢ Anomaliya asosida (Anomaly-based)
IPS ā€” Intrusion Prevention System

Aniqlaydi VŠ bloklaydi. "Aktiv" himoya. IDS + bloklash imkoniyati.

  • ā€¢ Inline joylashuv (traffic orqali o'tadi)
  • ā€¢ Real vaqtda bloklash
  • ā€¢ NGFW'ga integratsiya
Snort/Suricata Qoidalari:
# Snort qoida sintaksisi:
# action protocol src:port -> dst:port (options)

# Nmap port scan aniqlash
alert tcp any any -> $HOME_NET any \
  (msg:"Possible Nmap SYN Scan";
   flags:S;
   threshold: type threshold,
   track by_src, count 20, seconds 1;
   sid:1000001; rev:1;)

# SQL Injection aniqlash
alert http any any -> $HTTP_SERVERS $HTTP_PORTS \
  (msg:"SQL Injection Attempt";
   content:"OR 1=1"; nocase;
   sid:1000002; rev:1;)

# Reverse shell aniqlash
alert tcp $HOME_NET any -> any any \
  (msg:"Possible Reverse Shell";
   content:"/bin/sh"; nocase;
   sid:1000003; rev:1;)
Snort
Cisco, bepul, keng tarqalgan
Suricata
Open source, tezroq
Zeek (Bro)
Tarmoq tahlili
OSSEC
HIDS, log tahlili

Cyber Threat Intelligence (CTI)

CTI ā€” hujumchilar, ularning metodlari va niyatlari haqida to'plangan amaliy ma'lumot. SOC jamoasi CTI yordamida proaktiv himoya choralarini ko'radi.

Strategic CTI

Yuqori darajali tendentsiyalar, tahdid aktyor profillari. CEO/Board uchun.

Operational CTI

Yaqin hujumlar, kampaniyalar, TTP lar. SOC menejeri uchun.

Tactical CTI

IoC lar (IP, domain, hash), SIEM qoidalari. Tier 1/2 uchun.

MITRE ATT&CK Framework:

Hujumchilar taktika va texnikalarining eng keng qo'llaniladigan katalogi. 14 ta taktika, 200+ texnika.

Reconnaissance Initial Access Execution Persistence Priv. Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
IoC (Indicator of Compromise) Turlari:
IP manzillar 185.220.101.x (Tor exit)
Domain nomlar evil-c2.xyz
URL lar /admin.php?cmd=
File hash (MD5/SHA256) a1b2c3...f9e8d7
Email mavzular "Urgent invoice"
Manba platformalari: VirusTotal, AlienVault OTX, MISP, Shodan, AbuseIPDB

Zaifliklarni Boshqarish (Vulnerability Management)

šŸ”
Aniqlash

Nessus, OpenVAS bilan skan

šŸ“Š
Baholash

CVSS bali, ta'sir tahlili

āš™ļø
Tuzatish

Patch, config o'zgartirish

āœ…
Tasdiqlash

Re-scan va yopilishini tekshirish

# Nessus asosiy skan turlar:
# Basic Network Scan ā€” Umumiy
# Advanced Scan ā€” Chuqur
# Web Application Tests ā€” Web app
# Credentialed Patch Audit ā€” Patchlar

# OpenVAS bilan skan (CLI)
gvm-start
gvm-cli --gmp-username admin \
  --gmp-password pass socket \
  --xml "..."

# Nikto web scan
nikto -h https://target.com \
  -Format html -o report.html
CVE ā€” Common Vulnerabilities and Exposures

Har zaiflikka noyob identifikator: CVE-2021-44228 (Log4Shell), CVE-2017-0144 (EternalBlue)

NVD ā€” National Vulnerability Database

NIST tomonidan yuritiladigan eng katta zaifliklar bazasi. CVSS bali va ta'rif mavjud.

Zero-Day zaifliklar

Hali patch chiqmagan zaiflik. Dark web da $100K ā€” $2M gacha sotiladi. NSO Group Pegasus shu orqali ishlagan.

Bilimingizni Sinang

1. SIEM ning asosiy vazifasi nima?

  • A) Faqat tarmoqni skanerlash
  • B) Log yig'ish, korrelyatsiya va tahdidlarni aniqlash āœ“
  • C) Parollarni saqlash
  • D) Firewall qoidalarini boshqarish

2. IDS va IPS ning asosiy farqi nima?

  • A) IDS tezroq ishlaydi
  • B) IPS bloklaydi, IDS faqat aniqlaydi va ogohlantiradi āœ“
  • C) IDS faqat bulutda ishlaydi
  • D) IPS dasturiy, IDS apparat

3. MITRE ATT&CK nimani tasvirlaydi?

  • A) Zaifliklar ro'yxati
  • B) Firewall qoidalari
  • C) Hujumchilarning taktika va texnikalari āœ“ ā€” TTPs katalogi
  • D) SOC metrikalari
Ijtimoiy Muhandislik Hodisalarga Javob