11 Strategies of a World-Class Cybersecurity Operations Center

If you are getting started in cybersecurity operations, evolving your existing security operations center (SOC), or engaging with a SOC regularly, 11 Strategies of a World-Class Cybersecurity Operations Center helps you understand what it takes to stand up, grow, and evolve a truly great SOC. Fully revised, this second edition includes new material and evolved thinking to bring a fresh approach to excelling at cybersecurity operations.

This book guides cyber professionals through applying mission context to 11 strategies of a world-class SOC:

• Strategy 1: Know What You Are Protecting and Why
• Strategy 2: Give the SOC the Authority to Do Its Job
• Strategy 3: Build a SOC Structure to Match Your Organizational Needs
• Strategy 4: Hire AND Grow Quality Staff
• Strategy 5: Prioritize Incident Response
• Strategy 6: Illuminate Adversaries with Cyber Threat Intelligence
• Strategy 7: Select and Collect the Right Data
• Strategy 8: Leverage Tools to Support Analyst Workflow
• Strategy 9: Communicate Clearly, Collaborate Often, Share Generously
• Strategy 10: Measure Performance to Improve Performance
• Strategy 11: Turn up the Volume by Expanding SOC Functionality

Kathryn Knerler has decades of experience in cybersecurity. Her experience includes cyber analysis, incident response, and network security architecture. She is a Department Manager and Senior Principal Cybersecurity Architect in MITRE Labs' Cyber Solutions Innovation Center. She specializes in cyber threat intelligence and advising executives in operationalizing threat defense strategies. Prior to MITRE, she advanced from incident responder to Program Director of Computer Incident Advisory Capability (CIAC) at Lawrence Livermore National Laboratory (LLNL). Kathryn has a B.S. in Electrical Engineering, a M.S. in Cybersecurity, and an M.B.A.

Ingrid Parker has worked in cybersecurity roles spanning from operational hands-on analysis through engaging with CISO's of large federal departments and agencies. She is currently the Chief Engineer for the Homeland Security Enterprise Division at MITRE where she provides expertise across a range of cybersecurity topics and integrates new ideas, capabilities, solutions into the work programs. Prior to joining MITRE Ingrid worked as a malware, forensic, and cyber threat intelligence analyst for Northrop Grumman and served in the U.S. Army as a systems administrator and network engineer. Ingrid has a B.F.A. in Graphic Design and a M.A. in Information Management.

Carson Zimmerman has been working in cybersecurity for nearly 20 years. In his current role at Microsoft, Carson leads an investigations team responsible for defending the M365 platform and ecosystem. Previously at The MITRE Corporation, Carson specialized in cybersecurity operations center architecture, consulting, and engineering. In his early days at MITRE, Carson worked in roles ranging from CSOC tier 1 analysis, to secure systems design consulting, to vulnerability assessment. Carson has a B.S. in Computer Engineering and an M.S. in Information Systems.