Since I spend so much time talking to and researching SOCs and SOC analysts, I often get asked, "What the biggest difference is between high and low growth SOCs?"
The answer? Expectations.
1/
The answer? Expectations.
1/
First, what do I mean by growth? I'm talking about places where analysts can grow their abilities. These are the places that take complete novices and help them achieve competence or take experienced analysts and help them specialize. Growing human ability.
2/
2/
The organizations that support growth well are those where leadership has high (but realistic) expectations for analysts. These most often center around expecting the analyst to be able to make reliable, evidence-driven decisions confidently.
3/
3/
I remember teaching in an org once where I posed a scenario and told an analyst "What if you couldn't explain why this happened?"
They didn't understand -- "Why wouldn't I be able to explain what happened?"
4/
They didn't understand -- "Why wouldn't I be able to explain what happened?"
4/
This was a person only a couple of years into their career. Their leadership had an expectation that analysts made decisions based on what they knew DID and DO NOT happen. They also gave them the tools and data to get there.
5/
5/
When I see organizations that don't have the right expectations, it is primarily due to putting the wrong people in management positions. Poor access to tools and data is usually a symptom of that.
6/
6/
This is a good time to remember that computer security is not science -- there's no true phenomenon whose explanation is outside our capabilities. It's engineering. You can explain everything a computer does with the right people in the room.
7/
7/
When analysts have that mindset and the folks around them who support it, their growth is multiplied. They take ownership of the task of understanding why things happen and when they do that, their confidence soars. It's a game-changer.
8/
8/
The work of the analyst is hard. Very hard. Experienced folks forget that because of the curse of knowledge -- it's hard to remember what it was like not to know something. But, this work is still primarily engineering of known quantities. The questions ARE answerable.
9/9
9/9
Also, if you're the sort of analyst who sets high expectations of yourself even when your manager doesn't, good on you. You can lead from the bottom. Folks will recognize your success and it might not be long before you're the manager and can set better expectations for all. 10/9
• • •
Missing some Tweet in this thread? You can try to
force a refresh
