From 2017 to 2021: Integration of an Operational Situation Awareness Team to a CSIRT...
summary
A team created in 2017 embeds operational situational awareness inside the CSIRT, pairs it with operational activity regulation, and produces regular situation-analysis reports (from daily to multiweek cadence) plus ad‑hoc threat analyses used for prioritization and political briefings. Tools include a matrix mapping attack technique versus impact, statistics/indicators, and forensic timelines. The model needs about six analysts and 2–3 regulators for 2020 volumes, proves decisive during complex 2019 incidents and the 2020 pandemic, and faces hiring and detail‑level tradeoffs.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:17Operational Situational Awareness
- 3:53Important Reasons of Creating a Specific Team and Integrating It through Incident Response Teams
- 5:55Operational Activity Regulation
- 13:13Cyber Defense Operations
- 22:52Challenges
- 24:02Human Resources Challenges
related talks
49mStories from the SOC Front Lines
31mApproaches & Practices for Increasing the Maturity & Capabilities for CSIRTs in Emerging Economies
34mCSIRT and SOC Modernization Practices
53mSecurity Operations 2018: What Is Working? What Is Not.
46mCreating an AI Security and Incident Response Team
34mImproving Sector Based Incident Response
37mMore Than a CSIRT: Lessons Learned from Supporting a National Response to COVID-19
26mIf CSIRTs are Knights, CTI Teams are Queens