Foresight Evaluation: Improving Foresight Quality and Achieving Desired Outcomes

SOC Analyst 1 - (Beginner) Tier 1 Analysts inside the SOC use information collected from a variety of sources (IDS Alerts, Firewalls, Network Traffic Logs, etc.) to identify, analyze, and report events occurring within the network. The SOC Analyst 1 Learning path equips your team members with the basic knowledge and abilities required for elite performance including SIEM based investigations, log analysis, and proper use of a Firewall.

SOC Analyst 2 – (Intermediate) Tier 2 Analysts are responsible for responding to any crisis or urgent situation within their pertinent domain to mitigate immediate and potential threats. The SOC Analyst 2 Learning Path ensures your Tier 2 Analysts have the more advanced skills required for their role including host-based investigations, attack response, advanced log analysis, and use of more advanced tools such as an EPP platform.

Executive Leadership – (Intermediate) Give executives hands-on practice responding to a full blown Cyber Crisis. In this skills development and simulation module, executives get an opportunity to practice in a fully realistic simulated environment. Possible situations range from: ransomware scenarios where they must decide whether or not to pay the ransom, creating and approving public statements regarding breaches, sharing breach information with law enforcement agencies, etc. All so that when incidents do arise, executive management is equipped with the necessary skills to respond fast and effectively to emergent situations.

Senior Management – (Beginner) Quarterly breach response drills coaches senior managers and business owners by simulating cyber attacks that are relevant to them. Each session lasts approximately 4 hours depending on need and sessions can be tailored to fit the exact departmental needs. Sessions will provide the tools to: simulate effective breach notifications, assess business impact, make business decisions regarding services shutdown/runtime in crisis time and making sure the business is affected as little as possible. Possible scenarios can cover ransomware, to major data leaks, to DDoS attacks, to phishing and spam attacks. All aspects are targeted in a participatory way to give this group the tools they need to successfully lead their departments during a cybersecurity breach.

CISO and SOC Manager – (Advanced) Fully simulated cybersecurity skills development and practice will prepare CISOs and SOC managers to respond flawlessly when a cyber breach begins. Having practiced for the inevitable over and over, CISOs and SOC managers are better equipped to react optimally, despite the great pressure and intensity of the situation at hand. Simulation exercises also yield critical insights into organizational and procedural weaknesses and allow time to address them before the real crisis begins. The CISO and SOC manager should also run attack-scenario specific drills for all of the most pertinent cyber attack types: Ransomware, DDoS, Data & Privacy Leak, and more.

Tier 1 Security Analysts – (Intermediate to Advanced) Simulation exercises, modeled after the events they deal with on a daily basis, as well as emergency situations, help prepare Tier 1 analysts to react more efficiently and effectively in their daily work as well as emergent situations. Simulation exercises allow relatively new, inexperienced analysts to gain practical experience quickly, allowing them to build confidence and advance their skill level more quickly.

Tier 2 & 3 Security Analysts – (Advanced) This is a series of hands on workshops, presenting real environments with dedicated scenarios to improve particular skills that are critical to withstanding attacks, for example mobile forensics and ransomware reversing.

IT Department – (Intermediate) Skills development sessions help IT staffers understand their role in upholding and enforcing security policies. Sessions focus on creating smooth handovers, escalation protocols, crisis management and communication channels.

General Employees – (Beginner) Your general employees need to become educated in the very basics of cyber security awareness; they must learn what phishing emails look like, how to recognize fraudulent websites, how to create solid passwords and how to spot potentially malicious insiders. Sessions focus on learning the threat landscape and impact and learning to detect, avoid and report suspicious activity.

External Contractors – (Beginner) Partner security education should focus on reviewing security protocols and common “dos and don’ts”.