Diseño de un Security Operations Center (SOC), mediante la implementación de roles definidos por el Instituto SANS proporcionando las funciones de recopilar y filtrar datos, detectar y clasificar amenazas, analizar e investigar amenazas y la implementación de medidas preventivas para la red de la Unidad Educativa Salesiana María Auxiliadora - UESMA, ciudad de Esmeraldas

Abstract

The Unidad Educativa Salesiana María Auxiliadora - UESMA requested a design of Security Operations Center (SOC) because it wants to improve its security level and detection skills of cyber threats. It was proposed a design of a SOC prototype based in the SANS roles, that the UESMA will be able to collect and filter data, to detect, classify, analyze and investigate threats. The methodology “Roadmap for the implementation of pilot projects” was used. To determine the state of the infrastructure, were collected network data related with its security operations. The designed SOC will help to get the goals the UESMA's substantive functions. The prototype SOC was built in a simulation environment using VMware and ELK, Cuckoo, Moloch, Zabbix, GLPI, Grafana, PfSense, Windows Server, McAfee software. The functionality tests showed that the performance is stable and the penetration test showed that it is robust to external attacks. The values of the implementation and operation of the SOC was estimated that for the first year are below $ 300,000 and per operation from the second year onwards are under $ 200,000. Finally, in the legal, there were cited a group of laws that with the evidence collected by the SOC, would help to take legal actions.