Chapter 19 — Security operations and blue team: scope and theory
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 What security operations are"]
N2["19.2 SOC functions"]
N3["19.3 Incident response framework"]
N4["19.4 Continuous monitoring"]
N5["19.5 SOC models"]
N6["19.6 Maturity"]
N7["19.7 Theory and practice"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 What security operations are"]
N2["19.2 SOC functions"]
N3["19.3 Incident response framework"]
N4["19.4 Continuous monitoring"]
N5["19.5 SOC models"]
N6["19.6 Maturity"]
N7["19.7 Theory and practice"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 What security operations are]
|
v
[19.2 SOC functions]
|
v
[19.3 Incident response framework]
|
v
[19.4 Continuous monitoring]
|
v
[19.5 SOC models]
|
v
[19.6 Maturity]
|
v
[19.7 Theory and practice]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) define security operations and blue-team work; (2) explain SOC functions and services; (3) relate SOC work to incident response frameworks; (4) describe SOC models and maturity.
19.1 What security operations are
Security operations monitor, detect, analyse and respond to threats continuously. The blue team is the defending side, contrasted with red teams that simulate attackers under authorisation.
At Riverton, "continuously" is limited by staffing: student analysts cover daytime shifts and an engineer is on call overnight. The phishing campaign shows what that means in practice, since the first compromise happened at 02:14 and nobody looked until morning. Understanding the gap between the ideal of continuous operations and the actual rota is part of the theory too.
19.2 SOC functions
Knerler, Parker and Zimmerman (2022) group SOC functions into areas such as real-time monitoring and triage, incident analysis and response, threat intelligence, tooling and engineering, and expanded services like hunting.
Riverton's small SOC covers some of these well and others thinly. Monitoring and triage are done by student analysts, incident response by the two staff engineers with the service desk, and tooling by the same engineers in their spare time. Threat intelligence is mostly reading public advisories. Naming the functions shows where a single person is covering several roles.
19.3 Incident response framework
NIST SP 800-61r3 places incident response within cybersecurity risk management, aligned to CSF 2.0 functions: preparation sits in Govern, Identify and Protect; detection and response in Detect and Respond; recovery in Recover.
The alignment helps Riverton see that much of incident response happens before an incident. Requiring student MFA, for example, is preparation under Protect, and assigning the DPO's role in breach decisions is part of Govern. Without that preparation, detection and response start from a weaker position, as the phishing campaign showed when neither compromised student had enrolled.
19.4 Continuous monitoring
NIST SP 800-137 describes continuous monitoring as an ongoing programme tied to risk.
Tied to risk means monitoring effort follows what matters most: at Riverton, cloud sign-ins and mailbox changes receive the closest watch because the phishing campaign and similar attacks run through them. The programme also checks itself, as the source-health report in the data chapter does, so that a silent gap in collection is noticed rather than assumed away. Lucas's weekly check of cloud feeds is one small piece of that self-checking, and it found two short outages in its first term.
19.5 SOC models
SOCs may be internal, outsourced or hybrid. Riverton's is internal and small, using student analysts as a teaching programme.
The teaching programme shapes how the SOC works. Shifts follow the academic timetable, procedures are written for newcomers who change every year, and the two staff engineers spend part of their time training. Outsourcing overnight monitoring was considered after the campaign, but the cost and the loss of local knowledge led Dr. Kim to trial an on-call arrangement instead. The trial is reviewed after one term.
19.6 Maturity
The SOC-CMM (van Os, 2016) assesses maturity across business, people, process, technology and services. Riverton scores higher in technology than in process documentation.
The gap showed during the campaign: tools collected the right logs, but there was no written procedure for when to page the on-call engineer overnight. Students who saw early reports were unsure whether to wake anyone. Writing that procedure, with clear thresholds, became one of the first improvements, and the next assessment will show whether the process score rises.
19.7 Theory and practice
Vielberth et al. (2020) note that SOC research is fragmented; much practice relies on experience, so the course pairs theory with case work.
For Lucas, this means checking published ideas against Riverton's own data before relying on them. A finding from a large commercial SOC about alert volumes may not hold for a university with seasonal traffic and student analysts. The case work tests theory in a particular setting, and the setting sometimes shows where the theory needs qualifying. Lucas notes such qualifications in his reports.
Red, blue and purple
Red teams simulate attackers under written authorisation; blue teams defend; purple exercises bring both together so defenders learn which simulated actions they saw. Riverton runs a small purple exercise each year with an external firm.
Worked example
Lucas maps the phishing response onto CSF 2.0: Detect (user reports, z-score flag), Respond (resets, rule removal, notifications), Recover (restoring deleted mail for s3310), and Govern (decision to require student MFA).
Synthetic case. The mapping is invented.
Errors and limits
Frameworks describe what to achieve, not how a particular SOC should be staffed.
Exercises
- EX055 — Blue team. Define the blue team. Rubric: 3 = defenders who monitor, detect and respond; 2 = partial; 1 = attackers; 0 = none.
- EX056 — CSF mapping. Map two response actions to CSF functions. Rubric: 3 = e.g. resets → Respond; MFA decision → Govern; 2 = one; 1 = wrong; 0 = none.
- EX057 — Maturity result. What did Riverton's SOC-CMM view show? Rubric: 3 = stronger technology than process documentation; 2 = partial; 1 = vague; 0 = none.
Synthesis
Security operations theory frames SOC functions, frameworks and maturity, which the following chapters apply to the campus case.
Continue studying — chapter 19 of 40
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →