Confidence in Chaos: Strategies for World-Class Security Operations
summary
Covers a concrete, actionable roadmap: an 11‑strategy SOC model (updated from 10) with a 41‑function inventory to pick from, recommendations to consolidate capabilities under one roof or balance with local visibility, and to measure coverage by org, tech type, stack and ATT&CK mapping. Calls out costs like a 24x7 chair equaling ~4.8 FTE, warns most teams only control 1–10% (or even <1%) of their usable data estate while 90–99% lives elsewhere, and offers a free MITRE PDF and practical engineering‑ops integration patterns.
AI-written summary · about
chapters (12)
- 0:00Intro
- 3:16SOCS Operate in a Shifting Landscape
- 3:55The 11 Strategies
- 4:42Know What You are Protecting and Why
- 10:21Balance Size with Agility and Visibility
- 14:08Hire Well & Encourage Growth
- 17:11Illuminate Adversaries with Threat Intelligence
- 18:54Anticipating Adversaries
- 20:26Select and Collect the Right Data
- 24:46Leverage Tools to Support Analyst Workflow
- 27:58Balancing Sharing & Protection
- 30:25Conclusion & Questions
related talks
51mThe No BS SOC Story
32mThe SOC Of The Future… The Future Is Now
40mCybersecurity Operations Center Technology Taxonomy
53mSecurity Operations 2018: What Is Working? What Is Not.
41mOne SOC, The Whole SOC, and Nothing But The SOC, So Help Me
34mCSIRT and SOC Modernization Practices
20mSIEM There, Done That: Rising Up in the SecOps Revolution
47mField Guide to Building an Operational Technology Cybersecurity Capability