Joseph Muniz - The Modern Security Operations Center: The People, Process, and Technology for Operating SOC Services

Defending your organization from cyberthreats is a cat and mouse game. Both sides are constantly changing their tactics. When the defense tools work, the adversaries acquire the defense technology, reverse engineer it, and develop strategies to bypass it. When the adversaries start to succeed at bypassing security tools, defense companies take note, research the attack being used, and adjust defense capabilities in their tools to prevent future successful exploitation. Somewhere in between all of this back and forth is your organization.

Security is about the combination of people, process, and technology working together to accomplish a goal. You dont just buy a few products, plug them in, and magically eliminate the risk of being exploited. Security is a journey, which you must continue to invest in. It is not a destination. You dont one day become secure and be done with it. You cant buy your way to being secure. It requires an investment in a team responsible for security, commonly referred to as the security operations center (SOC).

My purpose for writing this book is to help every organization regardless of size, budget, or mission understand how to turn those responsible for the security of their organization into a security operations center. I do believe security is the responsibility of everybody in the organization, but one or more people need to have security as their primary job, and they need to be recognized for that role.

In this book, I describe how to build security services to support your organization. Some organizations run their business from the cloud. Other organizations do not. Some organizations have a budget to build a new SOC, while others need to convert what they have into a SOC that can support the organization now. Wherever you are at in your security journey, I have designed this book to incorporate industry guidelines, popular frameworks, and my own personal experience to give you an overview of how mature SOCs around the world run their security practice. I believe any organization can run a mature SOC as long as the organization recognizes its security team and what they do as a formal SOC.

My vision for this book is to take a vendor-agnostic approach to security with a focus on capabilities and best practices that will prepare you for the threats of tomorrow. I include tons of open-source and commercial product examples, but I always focus on the outcome of the recommendation so the vendor of choice wont matter. I reference specific guidelines to validate my recommendations and explain the risk of not performing what is covered in this book. I believe security professionals of all levels of experience can benefit from this book and I hope this book becomes a valuable asset in your journey against cyberthreats.