EP180 SOC Crossroads: Optimization vs Transformation - Two Paths for Security Operations Center

[chuvakin]

Guests:

• Mitchell Rudoll, Specialist Master, Deloitte
• Alex Glowacki, Senior Consultant, Deloitte

Topics: 

SIEM and SOC

Subscribe at Spotify.

Subscribe at Apple Podcasts.

Subscribe at YouTube

Topics covered:

• The paper outlines two paths for SOCs: optimization or transformation. Can you elaborate on the key differences between these two approaches and the factors that should influence an organization's decision on which path to pursue?
• The paper also mentions that alert overload is still a major challenge for SOCs. What are some of the practices that work in 2024 for reducing alert fatigue and improving the signal-to-noise ratio in security signals?
• You also discuss the importance of automation for SOCs. What are some of the key areas where automation can be most beneficial, and what are some of the challenges of implementing automation in SOCs? Automation is often easier said than done…
• What specific skills and knowledge will be most important for SOC analysts in the future that people didn’t think of 5-10 years ago?
• Looking ahead, what are your predictions for the future of SOCs? What emerging technologies do you see having the biggest impact on how SOCs operate?

Resources:

• “Future of the SOC: Evolution or Optimization —Choose Your Path” paper and highlights blog
• “Meet the Ghost of SecOps Future” video based on the paper
• EP58 SOC is Not Dead: How to Grow and Develop Your SOC for Cloud and Beyond
• The original Autonomic Security Operations (ASO) paper (2021)
• “New Paper: “Future of the SOC: Forces shaping modern security operations” (Paper 1 of 4)”
• “New Paper: “Future of the SOC: SOC People — Skills, Not Tiers” (Paper 2 of 4)”
• “New Paper: “Future Of The SOC: Process Consistency and Creativity: a Delicate Balance” (Paper 3 of 4)”