CFC Evolution

@ducklah @fkclai

Level 1: System Event Monitoring

Start with Anti-Virus and Firewall alerts and worked under the Network Operation Centre

Level 2: Security Monitoring

Introduce log integration with SIEM product, and start the playbook development, the first stage of blue team establishment

Level 3: Security Orchestration

Introduce SOAR, starting the automation security by integrating the developed playbook into the defense process. Offensive security is introduced in this stage to know yourself and know your enemy

Level 4: Threat-Informed Cybersecurity

Develop the threat intelligence capability integrated with threat hunting technique, and behavior-based analysis to establish an all-rounded proactive defense strategy

Level 5: Cyber Fusion Centre

Link with external defensive resources, perform threat analysis and integrate with the ISAC, contributing to the community

Last updated