How to Ruin your SOC in 5 Easy Steps
summary
Five actionable failure modes: rely only on SIEM logs instead of logs + network + endpoint visibility (use XDR); keep incident procedures in outdated binders instead of executable SOAR runbooks; automate responses without mapping dependencies (don’t blindly change ACLs or knock endpoints offline); omit a threat intelligence platform and cloud-delivered ML analytics for behavioral detection; and ignore human factors — institute job rotations, mentorships, and quarterly MSSP reviews to retain A‑players and avoid slow, noisy, brittle SOC operations.
AI-written summary · about
chapters (5)
related talks
51mThe No BS SOC Story
32mThe SOC Of The Future… The Future Is Now
41mOne SOC, The Whole SOC, and Nothing But The SOC, So Help Me
20mSIEM There, Done That: Rising Up in the SecOps Revolution
50mYou’re Doing It Wrong! Common Security Anti Patterns
53mSecurity Operations 2018: What Is Working? What Is Not.
13mTen Ways to Doom Your DevSecOps
54mSOCcing: Responding to a Cyber Incident