Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

03:00 PM
Connect Directly

A Day In The Life Of A Security Analyst

'The network doesn't lie' and host detection systems are also key tools for the analyst.

Some days start out quiet—too quiet—for a cybersecurity analyst. Others, not so much.

 “We never know what is going to happen. A day can start out calm or start out on fire and very quickly go from one or another,” says Jim Treinen, a security analyst for ProtectWise, who spends his days defending both his own company’s network as well as that of its customers.

Treinen, vice president of security research at cloud security provider ProtectWise, says his team is divided into two different groups. The first consists of the classic network security researcher-type analysts, who gather the bits and bytes of network traffic off the wire to determine what is good and bad, and who also pulls apart malware. The second group focuses on security analysis, performing behavioral analysis, machine-learning, and all the heuristic analysis that goes into judging what is legitimate activity and what is not.

First order of the day: Situational Awareness

For an analyst coming on shift, the first task of the day is a hand-over of activity and information from the analysts on the previous shift, especially if they are in a 24/7 security operations center. The analyst gets a briefing on the current events: ongoing incidents or things that are suspicious that need monitoring.  “We start there,” Treinen says.

“What are the key activities on the network? What are we monitoring? Is there something that we see that is a potential risk that we need to really come up to speed on quickly?”

And they watch to see what happens next. 

“The biggest problem we deal with especially in these large networks is the vast volume of things we need to watch. So where do we focus?”

An analyst can use a combination of tools and clues pulled from monitoring the network to determine which parts of the network to focus on first. This is where the hand-off, or situational awareness, from the previous analysts is helpful, as well as are tools that detect abnormal activity.

Fighting Attacks: Reactive Mode

Security analysts tend to work in two modes:  reactive mode, where they respond to alarms and information from their security tools; and calm/proactive mode, where they can proactively hunt for activity they think deserves attention so they aren’t always chasing down an event.

But what happens if things start to go bad quickly – a malware attack, virus escalation, a denial of service attack, or discovery of data theft?

The ideal scenario is to intercept attackers before they cause damage or steal information, according to Treinen. If analysts detect adversaries setting up an infrastructure to launch an attack or tunneling into the network, ideally, they would shut the infrastructure down and move to remediate the compromised machines before damage is done. That’s why analysts need to constantly monitor for activity such as a compromised host system calling out for malware updates or applications calling out for command and control type activity.

But the ideal doesn’t always happen.  So if a network is under attack, the logical step for the analyst is to develop a case file or incident file and start tracking the assets the security team thinks are under attack as well as track where the attacks are coming from. This activity becomes the focus point in the network.

“Depending on the types of tools you have in hand, you can trade searches off of that or elevate the monitoring of specific applications,” Treinen says.

An analyst will also watch for lateral movement to determine if the adversary is using the primary compromised applications or systems as a jumping point to get deeper into the network.  Automated remediation systems, or even the network engineering teams, should start closing systems down if that is warranted.

Doors into the network and systems need to be shut quickly. Analysts are also be focused on preserving any type of forensic evidence the SOC team can use internally to figure out how the bad guys got in or to preserve evidence if the organization calls in law enforcement. The bad guys most likely attempt to clean up after the attack to effectively delete their tracks.

Fighting Attacks: Calm Mode

Analysts can use the quieter times to proactively catch and mitigate attacks and security breaches. “If you have the right team and proactive analysts who are curious by nature and if they see something, they can pull on that thread to see where it leads them,” Treinen says.

Highly skilled attackers leave minimal tracks because they are stealthy. But an experienced senior analyst whose interest in an activity is piqued might be able to yield some fruit doing more in-depth analysis. Attackers are constantly changing the domains and IP addresses they use in order to escape detection, for example.  “If you keep enough history and enough memory of what has actually happened on your network, you can discover something you didn’t see before,” Treinen says.

Using tools that reconstruct the state of a network at any given point in time can give an analyst a powerful forensic search capability. Instead of just analyzing log data, the analyst can reconstruct the full network down to the packet-level to see who was talking to whom and which protocols were in use. Or the analyst might find evidence of compromised systems from a zero-day attack lying latent in the network, poised for future attack. 

“The network doesn’t lie; it gives you a true recording on what is going on,” Treinen says.

However, it takes more than one approach to find malicious activity; there is no silver bullet. So an analyst must also rely on host-based detection systems. You need a view of both network and host activity to get a full picture of threats, according to Treinen.

Related Content:


Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Click here for pricing information and to register.

Rutrell Yasin has more than 30 years of experience writing about the application of information technology in business and government. View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-05
jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service.
PUBLISHED: 2021-03-05
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javasc...
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and ea...
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlie...
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and ear...