Cybersecurity Operations Center Technology Taxonomy
summary
A practical, exhaustive SOC technology inventory is proposed, listing 30–40 specific tech types (EDR/HIPS, network IDS/IPS, SIEM, malware sandbox, tokenization, archiving, physical vaults, orchestration, ticketing) and mapping them to frameworks like NIST CSF and ATT&CK. The recorder reports many organizations buy but never deploy tools, recommends crosswalking needs to capabilities, using MITRE ATT&CK evaluations to pick effective vendors, and adds deception options like honeytokens and quarantine subnets and a shared spreadsheet to adapt and implement.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:03The Problem
- 2:20The Solution
- 4:49Stock Survey
- 5:47NIST Framework
- 6:54Functional Areas
- 10:14Categories
- 11:03Visibility
- 13:45Communications
- 15:04Operations
- 17:05Detection Protection
- 22:18Aggregation
- 24:47Deception
- 28:15Analysis
- 30:16Technology Thoughts
- 33:33How to Use the Taxonomy
related talks
30mThe SOC Counter ATT&CK
32mConfidence in Chaos: Strategies for World-Class Security Operations
32mThe SOC Of The Future… The Future Is Now
47mField Guide to Building an Operational Technology Cybersecurity Capability
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations
34mCSIRT and SOC Modernization Practices
54mSOCcing: Responding to a Cyber Incident
53mSecurity Operations 2018: What Is Working? What Is Not.