Key Function & Role

This structure provides a comprehensive view of how each functional team within the Information Security Center plays a vital role in protecting the organization's IT infrastructure, along with the systems they use and their priority.

1. Executive Leadership

Chief Information Security Officer (CISO)

• Priority: Critical

• Function: Provides strategic leadership, ensuring the company's cybersecurity posture aligns with its overall business goals and compliance requirements. The CISO oversees all cybersecurity operations and ensures effective communication between the security team and executive management.

2. Security Operations Center (SOC) Team

Security Analysts

• Priority: Critical for SIEM, Medium for SOAR

• Function: Monitors security systems, detects threats, and analyzes security events to protect against attacks. They play a critical role in maintaining the organization's security posture by continuously monitoring and investigating suspicious activities.

• Systems Used:

  • SIEM (Security Information and Event Management): Examples: Splunk Enterprise Security, IBM QRadar

  • SOAR (Security Orchestration, Automation, and Response): Examples: Splunk Phantom, Palo Alto Networks Cortex XSOAR

Incident Responders

• Priority: Medium

• Function: Responds to and mitigates security incidents, minimizing damage and recovery time. They are responsible for the immediate actions taken to contain, eradicate, and recover from security breaches.

• Systems Used:

  • SOAR (Security Orchestration, Automation, and Response): Examples: Splunk Phantom, IBM QRadar SOAR

Threat Hunters

• Priority: Medium

• Function: Proactively searches for hidden threats within the network, preventing potential breaches before they occur. Threat hunters use advanced techniques to uncover threats that evade automated detection systems.

• Systems Used:

  • Threat Intelligence: Examples: Recorded Future, FireEye Threat Intelligence

3. Security Engineering Team

Security Engineers

• Priority: Critical

• Function: Designs and implements security solutions, ensuring robust defense mechanisms are in place. They are responsible for the architecture and maintenance of security infrastructure.

• Systems Used:

  • Firewall Policy Management: Examples: Palo Alto Networks Panorama, Cisco Firepower Management Center

Network Security Specialists

• Priority: Critical

• Function: Protects the network from large-scale attacks aimed at disrupting services. They focus on safeguarding network integrity, availability, and confidentiality.

• Systems Used:

  • Anti-DDoS (Distributed Denial of Service): Examples: Cloudflare, Radware

4. Identity and Access Management (IAM) Team

IAM Specialists

• Priority: Critical

• Function: Manages user access, ensuring only authorized individuals can access sensitive data and systems. They handle authentication, authorization, and user provisioning.

• Systems Used:

  • Identity and Access Management (IAM): Examples: Okta, Microsoft Azure Active Directory

5. Vulnerability Management Team

Vulnerability Assessors

• Priority: High

• Function: Regularly scans for vulnerabilities, allowing the company to address weaknesses before they can be exploited. They assess the security posture and recommend improvements.

• Systems Used:

  • Vulnerability Scanning (Internal and External): Examples: Nessus, Qualys

Penetration Testers

• Priority: High

• Function: Conducts simulated attacks to identify and fix security gaps. They validate the effectiveness of security controls through ethical hacking.

• Systems Used:

  • Pentesting: Examples: Metasploit, Kali Linux

6. Application Security Team

Application Security Analysts

• Priority: High

• Function: Ensures the security of applications, preventing vulnerabilities and exploits. They implement security measures throughout the software development lifecycle.

• Systems Used:

  • IAST (Interactive Application Security Testing): Examples: Contrast Security, Synopsys

  • DAST (Dynamic Application Security Testing): Examples: OWASP ZAP, Acunetix

  • SAST (Static Application Security Testing): Examples: Fortify, Checkmarx

  • RASP (Runtime Application Self-Protection): Examples: Imperva, Waratek

  • Component Scan: Examples: Black Duck, Sonatype Nexus

  • Application Shielding: Examples: Arxan, Jscrambler

Secure Code Reviewers

• Priority: High

• Function: Reviews code for security vulnerabilities, ensuring secure application development. They identify and remediate vulnerabilities in the code before deployment.

• Systems Used:

  • Code Review Tools: Examples: Checkmarx, Veracode

7. Data Protection Team

DLP Specialists

• Priority: High

• Function: Protects sensitive data from unauthorized access and data breaches. They monitor and control data transfers to prevent data loss.

• Systems Used:

  • Data Loss Prevention (DLP): Examples: Symantec Data Loss Prevention, McAfee DLP

Key Management Specialists

• Priority: High

• Function: Manages cryptographic keys and secrets to ensure data protection and secure communications. They handle encryption and decryption processes.

• Systems Used:

  • Secret Management: Examples: Thales CipherTrust Manager, AWS Secrets Manager

8. Compliance and Governance Team

Compliance Officers

• Priority: Medium

• Function: Ensures the organization adheres to relevant cybersecurity regulations and standards, avoiding legal and financial penalties. They develop and enforce compliance policies.

• Systems Used:

  • Compliance Tools: Examples: IBM OpenPages, RSA Archer

Audit and Risk Management Specialists

• Priority: Medium

• Function: Conducts audits and manages risks to maintain a strong security posture. They evaluate and mitigate risks associated with cybersecurity.

• Systems Used:

  • Risk Management Tools: Examples: ServiceNow GRC, LogicGate

9. Threat Intelligence Team

Threat Intelligence Analysts

• Priority: Medium

• Function: Provides insights into emerging threats, enabling proactive defense measures. They gather and analyze threat data to inform security strategies.

• Systems Used:

  • Threat Intelligence: Examples: Recorded Future, ThreatConnect

10. Security Awareness and Training Team

Security Trainers

• Priority: Medium

• Function: Educates employees on security best practices, reducing the risk of human error. They develop and deliver training programs to raise security awareness.

• Systems Used:

  • Training Tools: Examples: KnowBe4, SANS Security Awareness

11. Incident Management Team

Incident Managers

• Priority: Medium

• Function: Coordinates response to security incidents, ensuring efficient and effective resolution. They manage the incident lifecycle from detection to recovery.

• Systems Used:

  • Incident Management Tools: Examples: IBM Resilient, ServiceNow Security Operations

12. IT and Network Operations Team

Network Administrators

• Priority: Medium

• Function: Monitors network traffic to detect and respond to anomalies and threats. They ensure network performance and security.

• Systems Used:

  • Network Traffic Analysis: Examples: Darktrace, Cisco Stealthwatch

System Administrators

• Priority: Medium

• Function: Maintains the health and security of IT systems and infrastructure. They manage servers, applications, and hardware to ensure stability.

• Systems Used:

  • System Monitoring Tools: Examples: SolarWinds, Nagios

13. Cybersecurity Operation Team

Security Tool Administrators

• Priority: Critical

• Function: Manages and maintains all cybersecurity tools, ensuring they are up-to-date and functioning effectively. They support the technical needs of the cybersecurity teams.

• Systems Used:

  • All Security Tools: Examples: All tools used across various teams

14. Offensive Security Team

Red Team

• Priority: High

• Function: Simulates real-world attacks to test the effectiveness of security controls and preparedness of the defensive teams. They identify vulnerabilities that could be exploited by adversaries.

• Systems Used:

  • Offensive Security Tools: Examples: Cobalt Strike, Red Canary