A SIEM (Security Information and Event Management) is a system that collects, analyzes, and correlates security logs from multiple sources, such as endpoints, firewalls, servers, etc. A SIEM can provide a centralized and comprehensive view of the security posture of an organization, as well as detect and respond to threats. Configuring endpoints to forward logs to a SIEM is the recommended method for collecting security logs from multiple endpoints, as it reduces the network bandwidth and storage requirements, simplifies the log management process, and enables faster and more effective security analysis. Leveraging an EDR (Endpoint Detection and Response) solution to request the logs from endpoints is not recommended, as it may cause performance issues on the endpoints, increase the network traffic, and create a dependency on the EDR solution. Connecting to the endpoints remotely and downloading the logs is not recommended, as it is a manual and time-consuming process, prone to errors and inconsistencies, and may expose the endpoints to unauthorized access. Building a script that pulls down the logs from all endpoints is not recommended, as it requires technical skills and maintenance, may not be compatible with different endpoint platforms, and may introduce security risks if the script is compromised or misconfigured.  References :

Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET) - Palo Alto Networks

Fundamentals of Security Operations Center (SOC)

10 Palo Alto Networks PCCET Exam Practice Questions - CBT Nuggets

In cloud computing, there are three main service models: Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). Each model defines the level of responsibility and control that the cloud provider and the cloud customer have over the cloud resources and services. The cloud provider is responsible for vulnerability and patch management of the underlying operating system in SaaS and PaaS models, while the cloud customer is responsible for it in IaaS model. In SaaS, the cloud provider delivers software applications over the internet and manages all aspects of the cloud infrastructure, platform, and application. The cloud customer only needs to access the software through a web browser or an API. In PaaS, the cloud provider offers a platform for developing, testing, and deploying applications and manages the cloud infrastructure and operating system. The cloud customer can use the platform tools and services to create and run their own applications. In IaaS, the cloud provider supplies the basic cloud infrastructure, such as servers, storage, and networking, and the cloud customer can provision and configure their own operating system, middleware, and applications.  References :  Cloud Computing Service Models ,  Cloud Security Fundamentals - Module 2: Cloud Computing Models ,  Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)

Local organization security policies are the rules and guidelines that define how a SaaS application can be used by the employees, contractors, and partners of an organization. These policies cover aspects such as authentication, authorization, data access, data protection, data sharing, and compliance.  Local organization security policies aim to ensure that the SaaS application is used in a secure, ethical, and legal manner, and that the organization’s data and assets are not compromised or misused 1 2 3 .  References :

Securing SaaS tools for your organisation - GOV.UK

SaaS Security: A Complete Best Practices Guide - BetterCloud

Security policy document examples for B2B SaaS apps

Forensics in a Security Operations process refers to collecting raw data needed to complete the detailed analysis of an investigation. Forensic analysis is a crucial step in identifying, investigating, and documenting the cause, course, and consequences of a security incident or violation. Forensic analysis involves various techniques and tools to extract, preserve, analyze, and present evidence in a structured and acceptable format. Forensic analysis can be used for legal compliance, auditing, incident response, and threat intelligence purposes.  References :

Cyber Forensics Explained: Reasons, Phases & Challenges of Cyber Forensics

SOC Processes, Operations, Challenges, and Best Practices

What is Digital Forensics | Phases of Digital Forensics | EC-Council

 Border Gateway Protocol (BGP) is a protocol that enables ISPs and NSPs to exchange routing information among themselves. BGP is used to determine the best path for sending data packets across the Internet. BGP is also known as the protocol of the Internet backbone, as it connects different autonomous systems (ASes) that form the Internet. BGP is not used by end systems or local networks, but only by routers that operate at the border of ASes. BGP is a complex and dynamic protocol that can handle changes in network topology, traffic load, and policy requirements.  BGP is also a scalable protocol that can support the growth of the Internet 1 2 3 4   References :

1 : Internet service provider - Wikipedia

2 : 1.8: Internet Backbones, NAPs, and ISPs - cs.huji.ac.il

3 : Lecture Notes – Unit 2 How does the Internet work?

4 : Border Gateway Protocol - Wikipedia

page 211 " Consolidating servers within trust levels: Organizations often consolidate servers within the same trust level into a single virtual computing environment: ... ... ... This virtual systems capability enables a single physical device to be used to simultaneously meet the unique requirements of multiple VMs or groups of VMs. Control and protection of inter-host traffic with physical network security appliances that are properly positioned and configured is the primary security focus. "

Sanctioned SaaS applications are those that are approved and supported by the organization’s IT department. They provide business benefits such as increased productivity, collaboration, and efficiency. They are fast to deploy because they do not require installation or maintenance on the user’s device. They require minimal cost because they are usually paid on a subscription or usage basis, and they do not incur hardware or software expenses.  They are infinitely scalable because they can adjust to the changing needs and demands of the organization without affecting performance or availability 1 2 .  References :  8 Types of SaaS Solutions You Must Know About in 2024 ,  What is SaaS (Software as a Service)? | SaaS Types | CDW ,  Palo Alto Networks Certified Cybersecurity Entry-level Technician

Security Operations (SecOps) is the process of coordinating and aligning security teams and IT teams to improve the security posture of an organization. SecOps involves implementing and maintaining security controls, technologies, policies, and procedures to protect the organization from cyber threats and incidents. When dealing with a known attack, SecOps must take the following action: document, monitor, and track the incident. This action is important because it helps SecOps to:

• Record the details of the attack, such as the source, target, impact, timeline, and response actions.

• Monitor the status and progress of the incident response and recovery efforts, as well as the ongoing threat activity and indicators of compromise.

• Track the performance and effectiveness of the security controls and technologies, as well as the lessons learned and improvement opportunities. References:

• Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)

• 6 Incident Response Steps to Take After a Security Event - Exabeam

• Dealing with Cyber Attacks–Steps You Need to Know | NIST

" Remember that a trust zone is not intended to be a “pocket of trust” where systems (and therefore threats) within the zone can communicate freely and directly with each other. For a full Zero Trust implementation, the network would be configured to ensure that all communications traffic, including traffic between devices in the same zone, is intermediated by the corresponding Zero Trust Segmentation Platform. "