Special Offer w/ OnDemand: Get an iPad (32 G), Galaxy Tab A, or Take $250 Off OnDemand Training thru Jan 27


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Sorry, the slides for this webcast are not available for download.

Its Been A Hard Year - 2020 Security Operations Center (SOC) Survey - SANS@Mic Keynote

  • Tuesday, December 15, 2020 at 7:30 PM EST (2020-12-16 00:30:00 UTC)
  • Chris Crowley

You can now attend the webcast using your mobile device!



2020 has seen major disruptions in IT and InfoSec operations status quo. Despite this, the SOC Survey ran again this year, and this talk will share the data reported and thoughts on what that means for you and your SOC team. The presenter, Christopher Crowley, is a Senior Instructor at the SANS Institute who focuses on security operations, data, and analytical methodology. 

Topics to be covered include: SOC functions / capabilities, architecture of the SOC, metrics used to report and assure performance, incident response details, barriers to success, hiring challenges, and of course demographics related to the respondents. We included a question about SOC analysts working from home, since that is the 2020 "thème de l'année."

Analysis based on the sectors and regions represented by the respondents will be presented, as will data dissection based on organizational size versus SOC capabilities. The past three years (2017, 2018, 2019) SANS SOC Surveys will be used as a basis for trend analysis, and wherever possible we'll include the comic relief of respondents quips and quotes as they answer the questions in the survey. 

The full data set of responses (with any identifiable data removed) will be released publicly, and Christopher Crowley is coordinating with several partner organizations to do their own data analysis of the data sets. Reference will be made to these analyses.

If you haven't taken the survey yet, please do so before it closes on October 31, 2020: https://www.soc-survey.com

Speaker Bio

Chris Crowley

Christopher Crowley is the course author for SANS Management 517 - Managing Security Operations and SANS Management 535 - Incident Response Team Management. Chris holds several industry certifications including the GSEC, GCIA, GCIH (gold), GCFA, GPEN, GMOB, GASF, GREM, GXPN, and CISSP. His teaching experience includes FOR585, MGT517, MGT535, SEC401, SEC503, SEC504, SEC560, SEC575, and SEC580; Apache web server administration and configuration; and shell programming. He was awarded the SANS 2009 Local Mentor of the year award. "The Mentor of the Year Award is given to SANS Mentors who excel in leading SANS Mentor Training classes in their local communities." Mr. Crowley spends his spare time mountain biking, rock climbing and savoring epicurean treats.

Need Help? Visit our FAQ page or email webcast-support@sans.org.

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.