'cybersecurity' 검색 결과

Create reusable procedures for responding to security incidents, from detection and containment to recovery. Define decision points, responsibilities, escalation rules, and workflows for security automation platforms so teams can follow a consistent response process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establishing an incident response program
• Documenting phishing or ransomware response procedures
• Designing automated security response workflows

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Build incident response dashboards that bring affected systems, containment progress, indicators of compromise, and response timelines into one view. Help security teams coordinate active incidents and prepare operational reports and executive briefings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Coordinating an active security incident
• Tracking affected systems and containment
• Reviewing response timelines after an incident

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns

Create threat detection rules in Sigma, a shared format for security log searches, and convert them for Splunk, Elastic, or Microsoft Sentinel. Validate syntax, test expected matches and false positives, and map coverage to MITRE ATT&CK.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Turning threat reports into detection rules
• Reusing detection logic across SIEM platforms
• Testing rule matches and reducing false positives

Design employee access management across multiple systems using HR records. This skill covers account changes when people join, move roles, or leave, along with role definitions, approval workflows, periodic access reviews, and cleanup of accounts left behind.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating account changes for hires, transfers, and departures
• Finding accounts that remain after employees leave
• Reviewing overlapping roles and unnecessary permissions

Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Importing external threat feeds into Splunk
• Matching network and endpoint logs against threat indicators
• Adding threat and asset context to alerts

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Build a repeatable process for Microsoft monthly security updates, from reviewing advisories and ranking vulnerabilities to testing, staged deployment, and verification. Helps teams set response deadlines based on risk and report remaining unpatched systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establishing a monthly Microsoft security update workflow
• Prioritizing vulnerabilities by exploitation risk
• Planning pilot and production deployment stages

Build threat actor profiles from public reports, social media, code repositories, and other intelligence sources. Correlates indicators, maps related infrastructure and attack techniques, and produces structured dossiers with confidence assessments about who may be responsible.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Consolidating public information about an attacker group
• Comparing aliases, targets, and motivations across sources
• Mapping related domains, IP addresses, and infrastructure

Draft malware incident communications for internal teams, executives, IT responders, customers, and regulators. Provides structured templates and severity-based notification workflows to organize impact details, response actions, decisions needed, and the timing of updates.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prepare an initial internal notification about a malware incident
• Summarize business impact and decisions for executives
• Draft technical response instructions for IT teams

Configure SAML identity federation, a way to share authentication between systems, linking on-premises Active Directory with Microsoft Entra ID. Cover single sign-on for cloud applications, user attribute mapping, authentication model choices, and signing certificate management.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extending on-premises authentication to cloud resources
• Comparing authentication models for hybrid identity
• Setting up SAML single sign-on for SaaS applications

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find paths from ordinary accounts to Domain Admin
• Review access permissions and group relationships
• Verify that hardening closed known attack paths

Review personal data handling against GDPR requirements, covering processing records, legal grounds, individual rights, breach procedures, and international transfers. Produce findings by article and a prioritized improvement roadmap with responsibilities, estimated costs, and timelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing evidence for a regulatory audit
• Reviewing privacy requirements for a new system
• Assessing GDPR gaps during acquisition due diligence

Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing accounts with directory replication rights
• Testing DCSync risks in an authorized lab
• Validating detection of replication abuse and forged tickets

Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Gathering public information before a penetration test
• Finding unknown internet-facing assets
• Checking public sources for leaked credentials and documents

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing security monitoring across multiple clouds
• Migrating from an existing SIEM platform
• Automating responses to suspicious cloud activity

Build a ransomware response playbook for security monitoring teams, covering detection, containment, eradication, and recovery. Include log queries, decision trees, evidence collection, backup restoration, and incident reviews to prepare consistent procedures before an attack occurs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating a standardized ransomware response playbook
• Documenting host isolation and recovery procedures
• Addressing coordination gaps found in tabletop exercises

Build a central vulnerability dashboard with DefectDojo to combine scanner findings, remove duplicates, and track remediation. Includes Docker deployment, automated scan imports from CI/CD pipelines, Jira ticket integration, and API queries for reporting metrics.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Combining findings from multiple security scanners
• Importing scan results automatically from CI/CD pipelines
• Connecting vulnerability findings to Jira tickets

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Analyze existing user permissions to propose roles for role-based access control, which assigns permissions by job role. Compare candidate role sets, identify overlap and excess access, and validate definitions against business responsibilities.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Consolidating overlapping access roles
• Redesigning roles from existing permission data
• Reviewing excess and unusual permissions