Security Operations Overview

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand what Security Operations (SecOps) is.
Learn how Security Operations Centers (SOCs) function.
Understand the Security Operations lifecycle.
Identify common security monitoring tools and AWS services.
Understand incident detection, response, and recovery.
Learn the daily responsibilities of a Cloud Security Engineer.

📚 Lesson Information

Estimated Time: 2 Hours

Difficulty: Beginner

Prerequisites: Risk Management Fundamentals

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Security is not a one-time activity.

Even after building a secure cloud environment, organisations must continuously monitor, detect, investigate, and respond to security threats.

Security Operations ensures that cyber threats are identified quickly, business disruption is minimised, and customer trust is maintained.

Every modern organisation has some form of Security Operations capability, whether it’s a dedicated SOC team or cloud security engineers managing cloud security services.

🌍 What is Security Operations?

Security Operations (SecOps) is the continuous process of protecting an organisation by:

Monitoring systems
Detecting threats
Investigating alerts
Responding to incidents
Recovering affected systems
Improving security controls

Security Operations never stops.

It operates 24 hours a day, 7 days a week.

🏢 What is a Security Operations Center (SOC)?

A Security Operations Center (SOC) is a team responsible for monitoring and defending an organisation against cyber threats.

The SOC continuously watches for:

Suspicious logins
Malware
Privilege escalation
Data exfiltration
Ransomware
DDoS attacks
Insider threats
Configuration changes

SOC teams investigate alerts before they become major security incidents.

👥 SOC Team Structure

A typical SOC consists of multiple roles.

Role	Responsibility
Tier 1 Analyst	Monitor alerts and perform initial investigations
Tier 2 Analyst	Investigate suspicious activity
Tier 3 Analyst	Advanced threat hunting and malware analysis
Incident Responder	Coordinate security incident response
Cloud Security Engineer	Secure cloud infrastructure and investigate cloud threats
SOC Manager	Lead SOC operations and reporting

Cloud Security Engineers often work closely with SOC analysts.

🔄 Security Operations Lifecycle

Every security event follows a structured process.

Monitoring
      │
      ▼
Detection
      │
      ▼
Analysis
      │
      ▼
Containment
      │
      ▼
Eradication
      │
      ▼
Recovery
      │
      ▼
Lessons Learned
      │
      ▼
Continuous Improvement

Security Operations is an ongoing cycle.

📡 Monitoring

Monitoring provides visibility into cloud environments.

Common monitoring activities include:

User logins
API activity
IAM changes
Network traffic
System performance
Security events
Application logs
Database activity

Without monitoring, attacks may go unnoticed.

🚨 Detection

Detection identifies abnormal behaviour.

Examples include:

Multiple failed login attempts
Root account usage
Public S3 buckets
Suspicious API calls
Malware detection
Unexpected geographic logins
Unusual network traffic

Early detection reduces business impact.

🔍 Investigation

Not every alert indicates an attack.

Security teams investigate:

Who performed the action?
When did it occur?
Which resources were affected?
Was the activity authorised?
What evidence exists?

Investigation relies heavily on logs and audit trails.

🚧 Containment

Containment limits the impact of an incident.

Examples:

Disable compromised IAM users
Remove malicious access keys
Isolate EC2 instances
Block malicious IP addresses
Restrict network access

The objective is to stop further damage.

🧹 Eradication

After containment, remove the root cause.

Examples:

Remove malware
Delete malicious accounts
Patch vulnerabilities
Rotate compromised credentials
Correct misconfigurations

🔄 Recovery

Restore business operations safely.

Activities include:

Restore backups
Validate system integrity
Resume normal operations
Monitor for recurring threats
Notify stakeholders

Recovery should follow documented procedures.

📖 Lessons Learned

Every incident should improve security.

Questions include:

What happened?
Why did it happen?
How could it have been prevented?
Which controls failed?
What improvements should be implemented?

Continuous improvement strengthens the organisation’s security posture.

☁️ AWS Security Operations Services

AWS provides multiple services to support Security Operations.

AWS Service	Purpose
CloudTrail	API logging and auditing
CloudWatch	Monitoring and alerts
GuardDuty	Threat detection
Security Hub	Centralised security findings
AWS Config	Configuration monitoring
Amazon Inspector	Vulnerability assessment
IAM Access Analyzer	Access analysis
AWS Backup	Data protection
AWS Shield	DDoS protection
AWS WAF	Web application protection

These services work together to improve visibility and response.

📋 Security Logs

Logs provide evidence during investigations.

Common log sources include:

CloudTrail Logs
VPC Flow Logs
Application Logs
Operating System Logs
Authentication Logs
Database Logs
DNS Logs
Firewall Logs

If logging is disabled, investigations become significantly more difficult.

🏢 Enterprise Scenario

CloudNova Technologies

At 2:30 AM, GuardDuty generates a High Severity Alert.

The alert indicates:

An IAM user authenticated from an unfamiliar country.
The user downloaded thousands of objects from an S3 bucket.
The access key had never been used from this location before.
CloudTrail shows multiple failed login attempts before the successful login.

As the Cloud Security Engineer:

Is this suspicious?
Which logs should you review?
What actions should you take immediately?
How would you contain the incident?
Which AWS services would help during the investigation?
What long-term improvements would you recommend?

🧪 Hands-on Exercise 1 — Explore AWS CloudTrail

Objective

Understand audit logging.

Steps

Log in to the AWS Console.
Navigate to CloudTrail.
Open Event History.
Review recent API activity.

Questions:

Which IAM user performed the action?
Which AWS service was accessed?
When did the event occur?
Why is CloudTrail important?

🧪 Hands-on Exercise 2 — Review CloudWatch

Navigate to:

AWS Console
↓
CloudWatch

Explore:

Metrics
Alarms
Dashboards
Logs

Questions:

What can CloudWatch monitor?
How could alarms improve incident response?

🧪 Hands-on Exercise 3 — Explore GuardDuty

Navigate to:

AWS Console
↓
Amazon GuardDuty

Review:

Findings
Severity Levels
Threat Types

Questions:

Which finding is most critical?
Why should high-severity findings be investigated immediately?

🧪 Hands-on Exercise 4 — Explore AWS Security Hub

Navigate to:

AWS Console
↓
Security Hub

Review:

Security Findings
Compliance Standards
Integrated Services

Questions:

Why centralise security findings?
Which AWS services contribute findings?

🧪 Hands-on Exercise 5 — Incident Timeline

Review the following timeline.

Time	Event
09:00	User logs in successfully
09:05	Access key created
09:10	Thousands of S3 objects downloaded
09:12	IAM policy modified
09:15	GuardDuty generates alert

Answer:

Which event appears suspicious?
What would you investigate first?
Which AWS logs would you review?
How would you contain the incident?

📊 Knowledge Check

Answer the following questions:

What is Security Operations?
What is a SOC?
What are the phases of the Security Operations lifecycle?
Why is monitoring important?
What is the purpose of CloudTrail?
What is GuardDuty used for?
What does Security Hub provide?
Why are logs essential during investigations?
What is the difference between containment and eradication?
Why are lessons learned important?

📝 Assignment

Prepare a Security Operations Review Report for CloudNova Technologies.

Include:

Overview of Security Operations.
Responsibilities of the SOC team.
Security Operations lifecycle.
AWS security monitoring services.
Incident response process.
Recommended monitoring strategy.
Suggested improvements for CloudNova Technologies.

Length: 3–4 pages.

💡 Key Takeaways

After completing this lesson, you should understand:

Security Operations is a continuous process of monitoring, detecting, investigating, responding to, and recovering from security incidents.
SOC teams play a critical role in protecting enterprise environments.
CloudTrail, CloudWatch, GuardDuty, Security Hub, and AWS Config provide visibility into cloud activity.
Logs are essential for investigations, compliance, and incident response.
Every security incident should result in improvements to people, processes, and technology.

📚 Further Reading

AWS CloudTrail Documentation
Amazon GuardDuty User Guide
AWS Security Hub Documentation
AWS Incident Response Guide
NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide
MITRE ATT&CK Framework (Overview)

🚀 Next Lesson

➡️ Enterprise Cloud Architecture