Cyber security is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. It’s also known as information technology security or electronic information security. The term applies in a variety of contexts, from business to mobile computing, and can be divided into a few common categories.
• Network Security
• Application Security
• Information Security
• Operational Security
• Disaster recovery and business continuity
• End-user education

A cyber-attack is a deliberate attempt by external or internal threats or attackers to exploit and compromise the confidentiality, integrity, and availability of information systems of a target organization or individual(s). Cyber-attackers use illegal methods, tools, and approaches to cause damages and disruptions or gain unauthorized access to computers, devices, networks, applications, and databases.

A SOC analyst is a cybersecurity specialist who monitors an organization’s IT infrastructure for threats. They are often the first responder in the battle against those threats. They also look for vulnerabilities and make improvements or recommend changes to strengthen security.
As mentioned, SOC analysts are often part of a larger security team. Some organizations hire SOC analysts in-house. However, companies that don’t have the time, resources, or desire to build an in-house SOC team may outsource to a dedicated SOC firm.

The nature of the role means that SOC analysts can vary widely in experience and seniority. But with this comes a number of opportunities to build skills and advance your career path. If you are looking to get into this area, you’ll find plenty of options to move forward to more senior positions.

These essential SOC capabilities include asset discovery, vulnerability assessment, behavioral monitoring, intrusion detection, and SIEM (security information and event management). In this chapter, we’ll review the details of these SOC tools.

s SOCs implement automation capabilities, so too will attackers, and with increasing sophistication

There are three pillars to the autonomous SOC:
• Data.
• Analytics.
• Community.