CSIRT and SOC Modernization Practices
summary
Practical roadmap for modernizing CSIRT/SOC: assess current operations, pick a maturity model (he recommends SIM3 or SOC‑CMM), map services to the new 26 roles from FIRST, and turn chosen initiatives into design, procurement and implementation workstreams. Concrete KPIs: monthly open incidents, outstanding incident trend, SLA breaches. Tool examples used in practice: TheHive, RT/OTRS or vendor CTM stacks; tie changes to clarified mandate, updated workflows, staffing/skills (NICE/ENISA mappings) and stakeholder coordination. Celebrate and publish results so the improvement actually sticks.
AI-written summary · about
chapters (4)
related talks
01h 29mFrameworks and Related Standards
31mApproaches & Practices for Increasing the Maturity & Capabilities for CSIRTs in Emerging Economies
32mConfidence in Chaos: Strategies for World-Class Security Operations
32mThe SOC Of The Future… The Future Is Now
51mThe No BS SOC Story
49mStories from the SOC Front Lines
40mCybersecurity Operations Center Technology Taxonomy
28mFrom 2017 to 2021: Integration of an Operational Situation Awareness Team to a CSIRT...