Organizational Design
There is no "one-size-fits-all" model for an optimal Security Operations organization. Several factors about the business and threat environments, even possibly international legal issues, need to be considered before deciding on an organizational design. And even that will need to evolve over time. But most organizations begin with traditional Tier 1 and Tier 2 roles:
- Operations activities and personnel (e.g., Operators)
- SecOps Call Center
- Real-time threat intel monitoring and internal communication
- Real-time system and network monitoring and triage
- Incident analysis
- Incident coordination and response
- Intelligence activities and personnel (e.g., Analysts)
- Cyber Threat Intel collection, analysis, fusion, tracking and distribution
- Forensic Analysis
- Malware Analysis
- Tradecraft Analysis
- Insider Threat Analysis
Operational Design
Processes in Security Operations typically start off very informal (by necessity), but evolve and mature quickly as the organization confronts more frequent and more sophisticated attacks and compromises.
Our Cybersecurity Design services can help define a practical set of SecOps tactics, techniques, and procedures (TTPs) that will continue to evolve as your organization matures.
- Monitoring processes
- Intelligence collection, fusion, and sharing processes
- Hunting techniques and procedures
- Escalation criteria and procedures
- Incident Response (IR) workflow
- Breach Response workflow
- Evidentiary Chain of Custody practices
- etc.
System Design
The majority of early-stage SecOps organizations define and organize themselves around the tools they collect and attempt to leverage. Most eventually arrive at a point where these disparate tools (their vendors) and the data they collect becomes unmanageable.
Our Cybersecurity Design services can help you develop a deliberate System Design that integrates your critical SecOps business systems.
- Monitoring strategy and instrumentation
- Collection strategy and infrastructure
- Retention strategy and infrastructure
- Analysis strategy and infrastructure
- Intel Fusion strategy and infrastructure
- Decision Support strategy and infrastructure
- Incident Response strategy and infrastructure
- Breach Response strategy and infrastructure
- etc.
Including planning and executing Technology Evaluations based on practical assessment criteria developed to capture the needs of your environment.