1 00:00:00,090 --> 00:00:01,050 In this lesson, 2 00:00:01,050 --> 00:00:02,430 we're going to discuss a concept known 3 00:00:02,430 --> 00:00:04,380 as a single pane of glass. 4 00:00:04,380 --> 00:00:05,640 Now, a single pane of glass 5 00:00:05,640 --> 00:00:08,700 is a central point of access for all the information, tools 6 00:00:08,700 --> 00:00:11,700 and systems the security team needs to effectively monitor, 7 00:00:11,700 --> 00:00:15,570 manage, and use to secure an organization's IT environment. 8 00:00:15,570 --> 00:00:17,940 A single pane of glass allows the security teams 9 00:00:17,940 --> 00:00:20,340 to have a unified view of their security posture 10 00:00:20,340 --> 00:00:23,190 and to quickly and easily access the information they need 11 00:00:23,190 --> 00:00:25,290 to make informed decisions. 12 00:00:25,290 --> 00:00:27,810 When using a single pane of glass security teams 13 00:00:27,810 --> 00:00:30,270 can see all of their security related information, 14 00:00:30,270 --> 00:00:34,410 including things like logs, alerts and reports in one place. 15 00:00:34,410 --> 00:00:36,960 This eliminates the need to log into multiple systems 16 00:00:36,960 --> 00:00:38,670 and reduces the time and effort required 17 00:00:38,670 --> 00:00:41,070 to manage your security operations. 18 00:00:41,070 --> 00:00:43,830 One of the main benefits of using a single pane of glass 19 00:00:43,830 --> 00:00:46,530 is that it simplifies the management of security operations 20 00:00:46,530 --> 00:00:48,030 by providing this unified view 21 00:00:48,030 --> 00:00:49,740 of security related information, 22 00:00:49,740 --> 00:00:51,660 that makes it easier for security teams 23 00:00:51,660 --> 00:00:53,670 to detect and respond to threats. 24 00:00:53,670 --> 00:00:56,010 Security teams can use a single pane of glass 25 00:00:56,010 --> 00:00:57,120 to monitor their environment 26 00:00:57,120 --> 00:00:58,980 for signs of suspicious activity, 27 00:00:58,980 --> 00:01:02,460 such as unusual traffic patterns or failed login attempts. 28 00:01:02,460 --> 00:01:04,200 They can also use it to track the progress 29 00:01:04,200 --> 00:01:05,850 of incident response activities 30 00:01:05,850 --> 00:01:08,310 and to ensure that all necessary steps are being taken 31 00:01:08,310 --> 00:01:09,990 to resolve an incident. 32 00:01:09,990 --> 00:01:11,070 A single pane of glass, 33 00:01:11,070 --> 00:01:12,570 also can improve the efficiency 34 00:01:12,570 --> 00:01:14,310 of your security operation center 35 00:01:14,310 --> 00:01:15,990 by automating many of the repetitive 36 00:01:15,990 --> 00:01:17,460 and time consuming tasks 37 00:01:17,460 --> 00:01:19,890 that most security teams have to perform. 38 00:01:19,890 --> 00:01:20,820 For example, 39 00:01:20,820 --> 00:01:23,100 security teams can use the single pane of glass 40 00:01:23,100 --> 00:01:25,890 to automate the collection and analysis of log data, 41 00:01:25,890 --> 00:01:27,510 reducing the time and effort required 42 00:01:27,510 --> 00:01:29,610 to identify those potential threats. 43 00:01:29,610 --> 00:01:31,110 This allows the security team 44 00:01:31,110 --> 00:01:33,150 to then focus on more important tasks, 45 00:01:33,150 --> 00:01:35,790 such as incident responses and threat hunting. 46 00:01:35,790 --> 00:01:37,860 Another benefit of a single pane of glass 47 00:01:37,860 --> 00:01:39,420 is that it improves collaboration 48 00:01:39,420 --> 00:01:42,060 and communication within the security teams. 49 00:01:42,060 --> 00:01:43,440 With a single pane of glass, 50 00:01:43,440 --> 00:01:45,600 security teams can easily share information 51 00:01:45,600 --> 00:01:46,890 and coordinate their efforts 52 00:01:46,890 --> 00:01:48,690 when they're responding to a threat. 53 00:01:48,690 --> 00:01:50,850 This helps to improve the overall security posture 54 00:01:50,850 --> 00:01:52,950 of the organization as security teams 55 00:01:52,950 --> 00:01:54,660 are able to work together more efficiently 56 00:01:54,660 --> 00:01:58,350 and effectively to identify and respond to the given threat. 57 00:01:58,350 --> 00:02:00,060 In addition to all of these other benefits, 58 00:02:00,060 --> 00:02:01,050 a single pane of glass 59 00:02:01,050 --> 00:02:03,330 can also make it easier for your security team 60 00:02:03,330 --> 00:02:06,360 to comply with regulatory and compliance requirements. 61 00:02:06,360 --> 00:02:08,160 Many regulations and standards, 62 00:02:08,160 --> 00:02:10,830 will require your organization to maintain detailed logs 63 00:02:10,830 --> 00:02:13,710 and reports of your security related activities. 64 00:02:13,710 --> 00:02:15,930 And a single pane of glass makes it much easier 65 00:02:15,930 --> 00:02:17,940 to generate these reports and logs 66 00:02:17,940 --> 00:02:20,730 by providing the documentation that the organization needs 67 00:02:20,730 --> 00:02:22,140 to be able to demonstrate compliance 68 00:02:22,140 --> 00:02:24,480 with the regulatory and compliance requirements 69 00:02:24,480 --> 00:02:26,400 that are being levied upon them. 70 00:02:26,400 --> 00:02:28,410 Now, a single pane of glass can be implemented 71 00:02:28,410 --> 00:02:30,450 as software or hardware, 72 00:02:30,450 --> 00:02:31,590 but most of the time 73 00:02:31,590 --> 00:02:33,870 it is going to be a software-based solution, 74 00:02:33,870 --> 00:02:34,950 because it's more flexible 75 00:02:34,950 --> 00:02:36,780 in terms of the types of data sources 76 00:02:36,780 --> 00:02:38,250 that can be integrated into it 77 00:02:38,250 --> 00:02:40,830 than a hardware based solution might have. 78 00:02:40,830 --> 00:02:42,330 Now, there are five main steps 79 00:02:42,330 --> 00:02:44,070 to implementing a single pane of glass, 80 00:02:44,070 --> 00:02:46,980 inside of your organization's security operation center. 81 00:02:46,980 --> 00:02:48,810 First, defining the requirements. 82 00:02:48,810 --> 00:02:51,660 Second, identifying and integrating data sources. 83 00:02:51,660 --> 00:02:53,790 Third, customizing the interface. 84 00:02:53,790 --> 00:02:56,070 Fourth, developing standard operating procedures 85 00:02:56,070 --> 00:02:57,240 and documentation, 86 00:02:57,240 --> 00:02:59,100 and fifth, continuously monitoring 87 00:02:59,100 --> 00:03:00,990 and maintaining the solution. 88 00:03:00,990 --> 00:03:03,600 Now, the first step in implementing a single pane of glass 89 00:03:03,600 --> 00:03:05,700 is to define your requirements. 90 00:03:05,700 --> 00:03:07,710 This involves identifying the information, 91 00:03:07,710 --> 00:03:09,990 tools and systems that your security teams 92 00:03:09,990 --> 00:03:12,210 are going to need to effectively monitor, manage 93 00:03:12,210 --> 00:03:15,150 and secure the organizations IT environment. 94 00:03:15,150 --> 00:03:16,440 This should include the types of data 95 00:03:16,440 --> 00:03:19,020 that need to be collected and analyzed such as logs, 96 00:03:19,020 --> 00:03:20,310 alerts, and reports, 97 00:03:20,310 --> 00:03:22,500 as well as any other tools that need to be integrated, 98 00:03:22,500 --> 00:03:24,120 such as intrusion detection systems 99 00:03:24,120 --> 00:03:26,610 and incident response platforms. 100 00:03:26,610 --> 00:03:28,380 Once the requirements have been defined, 101 00:03:28,380 --> 00:03:30,060 our second step is to identify 102 00:03:30,060 --> 00:03:31,920 and integrate the data sources. 103 00:03:31,920 --> 00:03:33,810 This involves identifying the data sources 104 00:03:33,810 --> 00:03:35,670 that your security team needs to access, 105 00:03:35,670 --> 00:03:38,490 including your log servers and intrusion detection systems 106 00:03:38,490 --> 00:03:39,450 and then integrating those 107 00:03:39,450 --> 00:03:41,790 into the single pane of glass solution. 108 00:03:41,790 --> 00:03:44,160 This can be done using APIs, web hooks, 109 00:03:44,160 --> 00:03:45,660 plugins or connectors 110 00:03:45,660 --> 00:03:47,790 to allow your single pane of glass to collect 111 00:03:47,790 --> 00:03:50,910 and analyze data from all your various data sources. 112 00:03:50,910 --> 00:03:52,500 It's also important to consider the data 113 00:03:52,500 --> 00:03:54,330 in terms of format and location 114 00:03:54,330 --> 00:03:55,950 and to make sure it's all correlated, 115 00:03:55,950 --> 00:03:58,110 so you can properly integrate it and analyze it, 116 00:03:58,110 --> 00:03:59,940 inside of your solution. 117 00:03:59,940 --> 00:04:02,190 The third step is to customize your interface 118 00:04:02,190 --> 00:04:03,690 of your single pane of glass 119 00:04:03,690 --> 00:04:04,950 to make sure it's meeting the needs 120 00:04:04,950 --> 00:04:07,140 of your security operations team. 121 00:04:07,140 --> 00:04:09,030 This includes designing the user interface 122 00:04:09,030 --> 00:04:10,980 and configuring the different panels and views 123 00:04:10,980 --> 00:04:13,650 that are going to be used to display information and data. 124 00:04:13,650 --> 00:04:15,900 It's also important to have a clear and organized layout 125 00:04:15,900 --> 00:04:18,300 that'll help the security team navigate through the data 126 00:04:18,300 --> 00:04:20,550 and make informed decisions quicker. 127 00:04:20,550 --> 00:04:22,380 The fourth step in the implementation 128 00:04:22,380 --> 00:04:25,560 is to develop the standard operating procedures or SOPs 129 00:04:25,560 --> 00:04:27,000 and associate documentation 130 00:04:27,000 --> 00:04:29,340 for your single pane of glass solution. 131 00:04:29,340 --> 00:04:31,050 This ensures that the security teams, 132 00:04:31,050 --> 00:04:32,940 know how to use the single pane of glass 133 00:04:32,940 --> 00:04:34,830 and understand the processes and procedures 134 00:04:34,830 --> 00:04:37,590 that are being used to manage security operations. 135 00:04:37,590 --> 00:04:39,540 It also helps to ensure consistency 136 00:04:39,540 --> 00:04:43,080 and repeatability in the management of security operations. 137 00:04:43,080 --> 00:04:44,460 The fifth and final step 138 00:04:44,460 --> 00:04:46,140 is to continually moderate and maintain 139 00:04:46,140 --> 00:04:48,180 your single pane of glass solution. 140 00:04:48,180 --> 00:04:50,550 This includes regularly reviewing the data and information 141 00:04:50,550 --> 00:04:51,690 that's being collected, 142 00:04:51,690 --> 00:04:53,940 as well as making adjustments as necessary 143 00:04:53,940 --> 00:04:55,380 to ensure the single pane of glass 144 00:04:55,380 --> 00:04:57,480 is meeting the needs of your security team 145 00:04:57,480 --> 00:04:59,580 and your security operation center. 146 00:04:59,580 --> 00:05:02,130 It's always important to ensure the single pane of glass 147 00:05:02,130 --> 00:05:04,320 is properly being configured and secured 148 00:05:04,320 --> 00:05:06,720 to protect against unauthorized access as well, 149 00:05:06,720 --> 00:05:09,960 because it holds all of your critical data inside of it. 150 00:05:09,960 --> 00:05:11,880 Now, as I said, there are many benefits 151 00:05:11,880 --> 00:05:13,860 to implementing a single pane of glass. 152 00:05:13,860 --> 00:05:15,420 This includes simplifying the management 153 00:05:15,420 --> 00:05:16,770 of security operations, 154 00:05:16,770 --> 00:05:18,930 making it easier for security teams to detect 155 00:05:18,930 --> 00:05:20,160 and respond to threats. 156 00:05:20,160 --> 00:05:22,470 Improving the efficiency of security operations 157 00:05:22,470 --> 00:05:24,060 by automating many of the repetitive 158 00:05:24,060 --> 00:05:25,350 and time consuming tasks 159 00:05:25,350 --> 00:05:27,270 that your security team needs to perform. 160 00:05:27,270 --> 00:05:28,380 Improving collaboration 161 00:05:28,380 --> 00:05:30,420 and communication within your security teams 162 00:05:30,420 --> 00:05:32,430 to allow them to work together more effectively 163 00:05:32,430 --> 00:05:34,350 to identify and respond to threats, 164 00:05:34,350 --> 00:05:36,450 as well as to make it easier for organizations 165 00:05:36,450 --> 00:05:39,060 to comply with regulatory and compliance requirements 166 00:05:39,060 --> 00:05:40,830 by providing the necessary documentation 167 00:05:40,830 --> 00:05:42,720 to demonstrate their compliance. 168 00:05:42,720 --> 00:05:43,890 So, remember, 169 00:05:43,890 --> 00:05:45,750 when you're utilizing a single pane of glass 170 00:05:45,750 --> 00:05:47,370 in your security operation center, 171 00:05:47,370 --> 00:05:50,310 it can really help to simplify the management of your SOC, 172 00:05:50,310 --> 00:05:52,350 improve the efficiency of your security teams 173 00:05:52,350 --> 00:05:54,600 and improve your overall security posture 174 00:05:54,600 --> 00:05:55,833 in your organization.