Building a Security Operations Program
summary
Uses the NIST-like identify protect detect respond recover sequence and gives concrete build steps: inventory crown-jewel assets, map dependencies, and automate continuous risk scoring; centralize logs with log normalization and baseline analytics; split mean time to detect into categories rather than one average and keep leadership vs ops metrics separate; push tier-one automated playbooks and use lightweight SOAR (even Python scripting) for orchestration; require an up-to-date incident response plan, tabletop exercises, clear MSSP handoffs, centralized incident management, and verified backups.
AI-written summary · about
chapters (14)
- 0:00Introduction to SOC program
- 1:48Identify phase overview
- 3:11Business environment documentation
- 4:54Asset and risk assessment
- 7:01Protect phase capabilities
- 9:07Documented security procedures
- 11:56Identity and access management
- 14:02Detect phase fundamentals
- 15:49Detection technology maintenance
- 17:55Automation in detection
- 20:05Respond phase priorities
- 22:56Incident response planning
- 24:21Team coordination in response
- 26:28Recovery and lessons learned
related talks
38mHow I Learned to Stop Worrying and Build a Modern Detection & Response Program
17mIncident Response @ Scale-Building a Next Generation SOC
54mSOCcing: Responding to a Cyber Incident
28mScaling Your Defenses: Next Level Security Automation for Enterprise
51mThe No BS SOC Story
49mTraining for Incident Response: The Red, the Blue, and the Ugly
53mSecurity Operations 2018: What Is Working? What Is Not.
51mCloudSec Hero to Zero: Self-Obsolescing Through Prolific Efficiency