Building and Leading Security Operations Centers

What You Will Learn

Are you looking to build, grow, or sharpen your cyber defense team? If so, the new MGT551: Building and Leading Security Operations Centers course is for you. MGT551 is a highly focused two-day crash course in planning, organizing, and improving your security operations. Throughout this course students can expect to learn key factors for success in managing a Security Operations Center (SOC), including:

Collecting the most important logs and network data
Creating playbooks and using case organization and storage
Using threat intelligence to focus your budget and detection efforts
Threat hunting and active defense strategies
Efficient alert triage and investigation workflow
Incident response planning
Choosing metrics and goals to improve the SOC
Team member hiring, training, retention, and prevention of burnout
SOC assessment through purple team testing and adversary emulation

While this course is focused on management and leadership, it is by no means theory only. Throughout the two days of instruction students will work on six hands-on exercises covering everything from playbook implementation to use case database creation, attack and detection capability prioritization and visualization, and purple team planning, execution, and reporting. Attendees will leave with a framework for understanding where their SOC should be focusing its efforts, how to track and organize defensive capabilities, and how to drive, verify, and communicate SOC improvements.

HANDS-ON TRAINING:

Defining Your Assets and Adversaries
Developing and Implementing SOC Playbooks
Structuring, Documenting, and Organizing Use Cases
Prioritizing and Visualizing Attack Techniques and Security Controls
Creating, Classifying, and Communicating Your Metrics
Purple Team Assessment Planning, Execution, and Tracking

YOU WILL BE ABLE TO:

Collect the most important logs and network data
Create playbooks and use cases
Use threat intelligence to focus your budget and detection efforts
Implement threat hunting and active defense strategies
Develop efficient alert triage and investigation workflow
Create effective incident response processes
Implement metrics and goals to improve the SOC
Conduct effective team member hiring, training, and retention, and prevent burnout
Assess your SOC through purple team testing and adversary emulation

WHAT YOU WILL RECEIVE:

Custom distribution of the Linux Virtual Machine containing free open-source SOC tools
MP3 audio files of the complete course lecture
Electronic Courseware
A digital download package that includes the above and more

Syllabus (12 CPEs)

Overview
MGT551 starts with the critical elements necessary to build your Security Operations Center: understanding your enemies, planning your requirements, making a physical space, building your team, and planning important data collection. Throughout this course section, students will learn how to build a strong foundation upon which an SOC can operate, including focusing defense on the most important users and data, and tailoring defense plans to high-risk threat groups. Through optimization of workflow, information organization, and data collection, you will learn how to ensure that your security operations will hit the ground running as efficiently as possible. Exercises show how to implement these concepts through threat group and asset profiling, playbook workflow creation and implementation, and the generation and organization of use cases for the SOC.
Exercises
- Defining Your Assets and Adversaries
- Developing and Implementing SOC Playbooks
- Structuring, Documenting, and Organizing Use Cases
Topics
Introduction
- What we are up against/industry surveys
- The average SOC
- What top-performing SOCs have in common
- SOC trends
- Class goals
SOC Functions
- High-level SOC diagram
- SOC functions
- Core activities
- Auxiliary functions
SOC Planning
- Do you need a dedicated internal SOC?
- What is and what is not a SOC?
- Mission and purpose
- Requirements
- Standards and frameworks
- Policies
- Roles
- Staffing levels
- Constituency
- Steering committee
- Services/Capabilities
- Charter
Building the SOC
- Physical space
- Analyst/SOC IT considerations
- Protecting SOC data
SOC Tools and Technology
- Foundational network and endpoint collection and detection technologies
- "Next-gen" must-have capabilities
- Advanced detection technologies
- Analyst core toolset
- Playbooks and SOAR
Team Creation, Hiring, and Training
- Organizational charts
- Choosing a tiered vs. tierless SOC
- Building a dream team
- Interviewing tips and techniques
- Interviewing mistakes and avoiding bias
- Training plans
Mental Models for SOC Operations
- Ops Tempo and the OODA Loop
- Threat modeling
- MITRE ATT&CK/Kill Chain
- Threat Intel - F3EAD
- Pyramid of pain and analytic types
- The SOC as an "infinite game"
Data Collection
- The SOC data collection system
- Open-source NSM and host-data tools
- Collection issues
Use Case Development and Storage
- Analytic rule types
- Analytic rule life cycle
- Use case organization and storage
Overview
The second day of MGT551 focuses on understanding and improving everyday SOC activities such as detection design, investigation and triage, threat hunting, active defense, and incident response. We'll look at all the exciting new tools in the blue team space that can improve your team in these areas. Additionally, we'll tackle common concerns such as employee retention and the prevention of burnout, as well as improvement measures such as analytic testing and false positive reduction, measurement and execution of SOC growth initiatives, adversary emulation, and purple team testing. Exercises include attack technique prioritization with MITRE ATT&CK Navigator, a guided exercise on how to define, derive, and track the most important metrics for your SOC, and a walk-through with examples of how to plan and track a purple team assessment to ensure your SOC is delivering on its goal of improving cyber defense and resiliency.
Exercises
- Prioritizing and Visualizing Attack Techniques and Security Controls
- Creating, Classifying, and Communicating Your Metrics
- Purple Team Assessment Planning, Execution, and Tracking
Topics
Detection and Analytic Design
- SOC threat detection systems
- Analytic outcomes and tuning
- Writing high-fidelity rules
- Dealing with high-volume alerts
- Risk-based scoring and alert aggregation
Analytic and Analysis Frameworks and Tools
- Blue team knowledge standardization and upcoming tools
- ATT&CK Navigator
- Yara
- Sigma
- Jupyter notebooks
- Detection testing labs
Threat Hunting
- What is threat hunting and why is it needed?
- Scheduling
- Data quality
- Hunting process and techniques
- Hunting maturity model
- Showing the value of threat hunting
Active Defense
- What is active defense/deception?
- Active defense techniques and goals
- Tooling
Alert Triage and Investigation
- Tiered vs. tierless SOC triage process
- Where to triage alerts
- Software for triage and desired features
- Prioritization of alerts
- Investigation issues and tactics
Incident Response (IR) Planning
- IR policy, plans, and procedures
- Staffing for IR
- Communication guidelines and methods
- IR go bags
- Live IR - Guarding your credentials
- Malware analysis sandboxes and analysis methods
- Containment procedures
- Eradication
- Watch and learn
- Recovery
- Post-incident activity
- Lessons learned
Staff Retention and Mitigation of Burnout
- Cultivating intrinsic motivation in your team
- SOC human capital model
- Burnout mitigation tactics for new and experienced analysts
- Optimizing tasks for analyst growth
- Performance management
Metrics, Goals, and Effective Execution
- Daily Ops vs. initiatives
- Metrics vs. KPIs. vs. OKRs
- Selecting metrics
- Selecting KPIs
- Creating OKRs
- Successful execution
Analytic Testing and Adversary Emulation
- Analytic testing
- Penetration resting, red teaming, and adversary emulation
- Purple team vs. red team execution and benefits
- Purple teaming

Prerequisites

This course does not have any specific prerequisites, but it is suggested that students have some experience in an operational security role. SANS courses such as SEC450 or MGT512 will give students a solid base-level understanding of the concepts that will be discussed.

Laptop Requirements

Important! Bring your own system configured according to these instructions!

We ask that you do 5 things to prepare prior to class start. This early preparation will allow you to get the most out of your training. One of those five steps is ensuring that you bring a properly configured system to class. This document details the required system hardware and software configuration for your class. You can also watch a series of short videos on these topics at the following web link https://sansurl.com/sans-setup-videos.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

Your host operating system must be either the latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Please download and install either VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to the beginning of class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website.

MANDATORY MGT551 SYSTEM REQUIREMENTS:

CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)

BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI

RAM: 8 GB (gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher is mandatory)

Disk: 25 gigabytes of free disk space

Connectivity:

Wireless Ethernet 802.11 B/G/N/AC
USB-A ports or an adapter to use a USB-A thumb drive (version 3.0 compatibility highly recommended)

Software:

VMware Workstation, Workstation Player, or Fusion
The Linux virtual machine will be provided to students

Configuration:

Please verify before coming to class that you have the administrative permissions required to transfer a virtual machine from a USB drive to your hard disk and start it. Also verify that Windows Device Guard, DLP, or other host-based protections will not interfere with the USB transfer or VM startup. (This is a common issue with company-built PCs, so if you intend to bring a corporate laptop, please test this before the event.)

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contactÂ laptop_prep@sans.org.

Author Statement

"Written to compliment my first SOC course (SEC450: Blue Team Fundamentals), MGT551 completes the security operations picture by introducing the best higher-level frameworks and organization tactics I've discovered throughout my career as a SOC analyst and manager for a large pharmaceutical company. By including hands-on application with state of the art open-source tools and methods for security operations, MGT551 delivers the complete package for SOC leaders. This course condenses years of knowledge and real-life experience with months of additional research to bring you the most important information to effectively and efficiently lead your security team to success.

As someone who has been the victim of less than ideal data collection and workflow, my goal with this course is to help ensure every organization's blue team runs at peak efficiency and capability, and no one has to suffer through repeating mistakes so commonly made within the industry. This course is the culmination of years of teaching, leading, and researching security operations and I am incredibly excited to bring it to the SANS community."

- John Hubbard

"Who can do it better than John? He explains things very clearly and is easy to listen to. His previous work experience sharing was insightful. Well done again!" - Muhammad Sulaiman, BSP Sdn Bhd

Ways to Learn

OnDemand

Study and prepare for GIAC Certification with four months of online access to SANS OnDemand courses. Includes labs and exercises, and SME support.

Live Online

Live, interactive sessions with SANS instructors over the course of one or more weeks, at times convenient to students worldwide.

Who Should Attend MGT551?

This course is intended for those who are looking to build a Security Operations Center for the first time or improve the one their organization is already running.

Ideal student job roles for this course include:

Security Operations Center Managers
New Security Operations Team Members
Lead / Senior SOC Analysts
Technical CISOs and Security Directors

"The information was pertinent and current for the environment SOCs are facing today" - Christopher Elliot, Hulu

See prerequisites

Reviews

This is a great management course for both those in start-up SOCs as well as established SOCs. As a newer leader myself, I found a lot of value in the leadership training as well.

Joel Kociemba

Bechtel

Directly applicable content and I have written down so many ideas.

Garry Byrne

Tesco Plc

I would recommend this course to anyone running a security operations team. I'd further recommend it to more experienced analysts so they can begin to see the bigger picture.

Robert Wilson

University of South Carolina

MGT551: Building and Leading Security Operations Centers

Course Authors:

John Hubbard