Tim Held

Most SOC roadmaps skip the essentials. Here's what actually works in 2026. I've broken down the SOC Analyst journey. From basics to landing your first role. BASICS - Your Foundation Master networking protocols and OS fundamentals. Understand Windows, Linux, and security principles. INTERMEDIATE - Build Your Skills Dive into log analysis across platforms. Learn the incident response lifecycle properly. ADVANCED - Stand Out Get hands-on with SIEM tools. Master detection engineering and threat hunting. CERTIFICATIONS THAT MATTER No shortcuts. No fancy tools first. Just the fundamentals that actually get you hired. Blue Team needs defenders who know the basics. Save this roadmap. Start learning today. Credited to the respected owners #SOCAnalyst #CyberSecurity #BlueTeam #InfoSec #CyberSecurityCareer #defensivesecurity #CyberSecurityCareers

50

This comes up a lot in conversations with growing teams 🔐 Security isn’t usually ignored; it’s just introduced in a way that feels heavy or unclear. When it’s practical and tied to real priorities, adoption looks very different. #Cybersecurity #GRC #RiskManagement #SecurityStrategy #Compliance #Startup #GrowingCompanies

10

𝗘𝘃𝗲𝗻 𝘀𝘁𝗿𝗼𝗻𝗴 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 𝗮𝗿𝗲𝗻’𝘁 𝗲𝗻𝗼𝘂𝗴𝗵 𝗮𝗻𝘆𝗺𝗼𝗿𝗲 Attackers now use replay attacks—reusing stolen credentials to access your systems without detection. That’s why DFARS, NIST SP 800-171, and CMMC 2.0 require replay-resistant authentication (IA.L2-3.5.4). Implement MFA, tokens, or smart cards to make each login unique, verifiable, and secure. Is your authentication strategy replay-resistant? Read more: https://cstu.io/31c5dc #Compliance #Cybersecurity #ReplayAttacks

1

Federal cybersecurity rollbacks have arrived—and they’re putting your organization at greater risk. SBOMs, secure development attestations, phishing-resistant MFA… it’s now up to us to demand transparency and enforce standards. LMG Security breaks down what has changed and how to respond:  https://lnkd.in/g9sRM3Dh #cybersecurity #thirdpartyrisk #MFA

3

🔐 CISSP Day 12, Domain 7: Deep-Dive into SIEM Concepts. 🧠 1️⃣ How SIEM Actually Correlates Events (Under the Hood) Correlation is NOT just “rule matching.” Modern SIEMs use multi-layered logic: • Rule-Based Correlation Example: 5 failed logins + 1 successful login → alert for password spraying. • Temporal Correlation Sequence-based analysis (e.g., login → privilege escalation → abnormal file access). • Statistical & Baseline Behaviour Correlation SIEM learns normal patterns, such as: typical login times normal data transfer volumes usual commands used by an admin Anything exceeding the statistical baseline is flagged. • Heuristic Correlation Uses expert-defined patterns such as: “New process spawned from unusual parent process” “Multiple endpoints contacting same suspicious IP” • Threat-Intel Driven Correlation Matching against IoCs: IPs, URLs, hashes, TTPs from MITRE ATT&CK. These layers create a high-fidelity alerting engine. 🧩 2️⃣ Event Normalisation: Why It’s Critical Different devices log differently. Example: Cisco logs “authentication failure” Windows logs “4625 event” Linux logs “pam_unix authentication error” SIEM converts all of these into a single standardised schema (e.g., ECS, CEF, LEEF). Without normalisation → correlation fails → blind spots appear. 🧬 3️⃣ Parsing & Enrichment: How SIEM Makes Events ‘Smart’ Before analysis, the SIEM enriches data with: ✔ Geo-IP Where did the IP originate? ✔ User Identity Which AD account was used? ✔ Asset Criticality Which machine is most important? ✔ Threat Intelligence Is this IP/domain/hash known to be malicious? This enrichment turns raw logs into context-rich security events, enabling higher detection accuracy. 🛰️ 4️⃣ SIEM’s Multi-Tier Architecture Most enterprise SIEMs use a three-tier architecture: 1. Ingestion Layer Collectors, forwarders, log shippers. Handles: parsing, preprocessing, buffering. 2. Processing Layer Core analytics engine: rules heuristics ML/UEBA correlation data enrichment 3. Storage & Retention Layer Hot storage → real-time queries Warm storage → investigation Cold storage → compliance retention (1–7+ years) CISSP stresses availability, integrity, and retention of logs for forensics. ⚙️ 5️⃣ SIEM Performance Engineering SIEM failures often occur due to engineering, not detection: • EPS (Events Per Second) Capacity If the SIEM exceeds EPS, it drops logs silently. This is one of the biggest forensic risks. • Log Source Tuning Not all logs are equal. Example: DNS, AD, Firewall = high priority Printer logs = low priority • Noise Reduction Use-case tuning prevents fatigue: remove benign events whitelist known patterns avoid duplicate alerts • Index Strategy Incorrect indexing → slow search, delayed investigations. 💡 Tip of the Day A SIEM is only as effective as the detection use cases built into it. 80% of SIEM maturity depends on: ✔ high-quality rules ✔ curated threat intel ✔ continuous tuning Buying a SIEM ≠ having security. 🗺️

6

1 Comment

CMMC Level 2 Assessment Objective: Application Execution Policy PRACTICE: Organizations must apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny. ASSESSMENT: Determine if: [a] a policy specifying whether whitelisting or blacklisting is to be implemented is specified; [b] the software allowed to execute under whitelisting or denied use under blacklisting is specified; and [c] whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified. Be prepared! 🔍 Examine configuration management policy; procedures addressing least functionality in the system; system security plan; configuration management plan; system design documentation; system configuration settings and associated documentation; list of software programs not authorized to execute on the system; list of software programs authorized to execute on the system; security configuration checklists; review and update records associated with list of authorized or unauthorized software programs; change control records; system audit logs and records; other relevant documents or records. 🗣 Interview personnel with responsibilities for identifying software authorized or not authorized to execute on the system. 📝 Test organizational process for identifying, reviewing, and updating programs authorized or not authorized to execute on the system; process for implementing blacklisting or whitelisting; mechanisms supporting or implementing blacklisting or whitelisting (CMMC Assessment Guide: Level 2 Version 2.13, page 108) MNS Group #CMMC #DoW #DoD #cybersecurity #NIST #InformationSecurity #CyberSecurity

6

Good morning! Here is this week's ICS Advisory, Other CERT, and Vendor vulnerability advisories weekly summary for 16 - 20 February 2026. Download this week's ICS Advisory Project Summary Slides for 2-23-2026. https://lnkd.in/edQurthQ This past week, CISA released 8 new CISA ICS Advisories for the following vendors: Jinan USR IOT Technology Limited (PUSR), Honeywell, EnOcean Edge Inc, Valmet, Welker, Siemens, Delta Electronics, and GE Vernova. No CISA ICS Advisories were updated this past week. Based on the new CISA advisory, Critical #Manufacturing, #Energy, #Chemical, #CommercialFacilities, #Food & #Agriculture, #InformationTechnology, and #Water & #Wastewater Systems are the potentially affected #criticalinfrastructure (CI) sectors. The ICS Advisory Project identified 6 new ICS Advisories for B&R Industrial Automation GmbH [Engineering Workstation/Control Software], Dassault Systèmes [Engineering Visualization/PLM Software], and Autodesk [CAD/Engineering Design Software]. For a more comprehensive understanding, you can view the summary details of other CERT & Vendor product advisories identified last week (16 - 20 February 2026) and read the vendor advisory using the links provided at: https://lnkd.in/eQaBF6aw This past week, CISA added 8 new Known Exploited Vulnerability (KEV) Catalog. None added this week correlated to a CISA ICS Advisory. Visit the ICS[AP] CISA KEV Catalog Dashboards: https://lnkd.in/emzXBbBw This past week, CISA released Siemens ICS Advisory for 1 Siemens Security advisories. CISA does not release ICS Advisories for Siemens Security Bulletins (SSBs) only Siemens Security Advisories (SSAs) View the filtered Siemens Security Advisory Updates to CISA ICS Advisories https://lnkd.in/e_ZXr2un View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides and Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4           I appreciate everyone's comments & support. Have a great week! #CISA #ot #ics #otcybersecurity #otsecurity #icssecurity  #cybersecurity #vulnerabilitymanagement #cybersecuritythreats #cybersecurityawareness #industrialautomation #IoT #buildingautomation #hydroelectric #Nuclear #oilandgas #defenseindustrialbase #renewables #wind #solar #pharma #SCADA #transportationsystems Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.

36

3 Comments

⚠️ COMPLIANT. BUT COMPROMISED. ⚠️ Most organizations are not losing cybersecurity they are killing it, knowingly or not, and replacing it with a performance. I call this Security Ghosting a term I coined. Controls exist on paper, dashboards are green, audit findings are closed. But the operational reality is different: logs exist but no correlation, SIEM exists but no use cases, EDR exists but no tuning, policies exist but no enforcement. Detection is weak, response is slow, and the attack surface keeps expanding. And the most critical failure: your best cybersecurity engineers are not doing real defense work they are busy producing reports, answering audits, and generating “evidence.” The people who should be building security are being used to simulate it. This is not security. This is a self-inflicted vulnerability. ⚠️ Verizon DBIR has been saying this for years: most breaches don’t happen because of missing controls, but because existing controls are not actually implemented. The problem is not lack of technology it is non-operational security. 🔒 Compliance ≠ Security. Evidence ≠ Control. If your best engineers are preparing audit documentation instead of detecting attacks, you’ve already lost. An organization that is better at passing audits than stopping attacks is not secure it only looks secure. 🔥 How many companies are truly protected, and how many are just practicing Security Ghosting? #CyberSecurity #SecurityGhosting #CISO #InfoSec #CyberResilience #SecurityLeadership #RiskManagement #Compliance #CyberRisk #DigitalRisk #BlueTeam #SOC #ThreatDetection #IncidentResponse #SIEM #EDR #CyberDefense #SecurityEngineering #ZeroTrust #Leadership

280

378 Comments