Security Operations Center

Our Mission

As industry leaders, the Texas A&M Security Operations Center (SOC) protects and educates people and organizations in the public sector so you can stay calm in a threat filled world. Managing network security can be difficult; we provide a wide-range of services to help fulfill your security needs

Domain Name System (DNS) Filtering

Many cybersecurity threats utilize DNS to bypass IP block lists. Maintaining only a blacklist of known bad DNS entries does not completely resolve the risks. It is common behavior for a malicious actor to use dynamically generated DNS entries to bypass these lists. We manage tools that will evaluate all DNS queries seen from your organization, as well as from any endpoints external to the network utilizing a roaming client. This service stops known bad DNS calls, and access to any newly seen domains (less than 6 days old or never seen by the vendors global network), preventing the majority of malicious code dispersed

We Provide

Assistance in deploying the solution
The ability to add in content monitoring
Off-network protection and malicious device identiﬁcation available with roaming client
User identiﬁcation

Threat Detection & Monitoring

First, we will meet with you to understand your environment. We will then detect and hunt for known and unknown threats and provide analysis of real-time security event data feeds to detect indicators of threats. Incidents are escalated to our analysts for in-depth analysis. Analysts will send Threat Indicator Notiﬁcations with information about detected threats while adding contextual information and How-To’s to the notiﬁcations for faster validation and delegation. Every notiﬁcation has analyst insight that is speciﬁc to the detection and present situation of your environment

We Provide

Threat detection and monitoring
Triage of events
- Alerts are prioritized according to the alert severity and the criticality of the impacted host(s)
In-depth analysis of security events and threat indicators
Threat Indicator Notiﬁcations
Monthly reports: Situational Awareness, Threat Landscape, Attacks, Key Performance Indicators
Security Advisories Subscription
Invitation to our regular Threat Brief conference call

Software Contracting and Evaluation

As the industry shifts to combat the latest threats, it is necessary for tools used to combat those threats shift as well. We actively work with vendors to determine products that meet your needs and negotiate group purchases when applicable

We Provide

Tools available at a lower price point through group purchasing
On-going evaluation of new products
Recommendations on tools alongside consulting to meet your specific needs

Vulnerability Scanning and Penetration Tests

External and internal vulnerability scanning is available to provide you with a better picture of assumed risks. These scans are designed to meet the requirements of state law and to help your organization resolve any unknown vulnerabilities. Penetration testing is provided through third-party contracts

Remote Incident Response

Remotely, the SOC provides expertise in analyzing damage and removing changes left by an adversary. Support is usually done over the phone, email, web conference, or if necessary, remote terminal or administrative interfaces such as a collaborative meeting platform or Secure Shell (SSH)

We Provide

Service and Engagement – based on the type of incident and availability
On-site Incident Response – based on the impact of the threat and availability

Training and Awareness

Proactive outreach to employees supporting general user training, bulletins and other educational materials that help them understand various cybersecurity issues. The main goals are to help you protect your team from common threats, better secure end systems and help employees correctly report cybersecurity incidents

Log Collection & Correlation

Splunk is a platform that allows for log collection, event correlation and dashboarding. We have secured discounted Splunk licenses that are available to you for an additional fee. The SOC provides two license models, stakeholder run and SOC run instances

We Provide

Onboarding of Splunk log data into Splunk
Security monitoring and correlation (where applicable)

Security Consulting

We are happy to provide security advice for:

Supporting new system design
Business continuity
Disaster recovery planning
Securing, monitoring and auditing Microsoft Active Directory

Interested? Contact us for more information!

The Texas A&M University System | Security Operations Center | soc@tamus.edu | 979.234.0030