Chapter 32 — Security operations and blue team: interdisciplinary interfaces
Lesson map
Lesson 32 published. Map, example, EX094.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Many disciplines"]
N2["32.2 Legal and privacy"]
N3["32.3 HR and student affairs"]
N4["32.4 Communications"]
N5["32.5 Academics"]
N6["32.6 Translating"]
N7["32.7 Joint procedures"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX094"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Many disciplines"]
N2["32.2 Legal and privacy"]
N3["32.3 HR and student affairs"]
N4["32.4 Communications"]
N5["32.5 Academics"]
N6["32.6 Translating"]
N7["32.7 Joint procedures"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX094"]
[Learning outcomes]
|
v
[32.1 Many disciplines]
|
v
[32.2 Legal and privacy]
|
v
[32.3 HR and student affairs]
|
v
[32.4 Communications]
|
v
[32.5 Academics]
|
v
[32.6 Translating]
|
v
[32.7 Joint procedures]
|
v
[Worked example] --> [Exercise EX094]
Learning outcomes
You will (1) work with legal, privacy, HR, communications and academic staff; (2) translate technical findings for non-technical colleagues; (3) respect different professional duties; (4) agree joint procedures.
32.1 Many disciplines
SOC incidents touch law (data protection, evidence), HR (staff misconduct), student affairs (student discipline), communications (public statements) and academic departments (research data). Each has its own duties and language.
The s2047 case alone involved the DPO for the exposed marks; the research server case involved a professor and a data owner. Each office asks different questions: the DPO asks what personal data left, the professor asks whether participants are affected. The SOC must answer each in the right terms. Lucas notes each office's questions.
32.2 Legal and privacy
The data protection officer decides on breach notifications; the SOC supplies facts. Legal staff advise when evidence may be needed in proceedings.
In the s2047 case, Lucas supplied the list of forwarded messages and their subjects; the DPO decided that three students must be informed. Legal staff would have been involved if the evidence had been needed for disciplinary proceedings, which would have required the chain-of-custody record from the evidence chapter. Lucas never offers an opinion on whether notification is legally required, even when asked informally. Doing so could mislead people who later rely on the DPO's actual decision.
32.3 HR and student affairs
If an incident suggests misconduct by staff or students, the SOC passes facts to HR or student affairs and does not investigate the person beyond the security question.
The limit protects people's rights. If logs suggested a student had shared their password with a friend, the SOC's question would be whether the account is secure; whether the student broke rules is for student affairs. The SOC reports facts and stops there. In such a referral, Lucas's note states only what the logs show and when, without conclusions about intent. Student affairs may ask further questions through Dr. Kim, never directly to an analyst.
32.4 Communications
Public statements are written by the communications office with SOC facts; analysts do not speak to journalists.
During the exam-week campaign, the communications office published the campus notice using facts from the SOC: the subject line, what to do and how to report. When a student newspaper asked about the campaign, the query went to the communications office, which answered without naming any affected account. Lucas forwarded the newspaper's query without replying, as the procedure requires. Analysts who speak informally to reporters may reveal details that identify victims or tell attackers what the SOC knows, so even friendly questions are passed on.
32.5 Academics
Researchers value openness; security requirements must be explained in terms of protecting their work and participants.
For the physics group, restricting SSH was presented as protecting their GPU time and datasets from misuse, not as a rule from central IT. The trial week, during which remote collaborators used the VPN, showed the change would not stop their work, which made agreement easy. Lucas also met the group's postdocs, who ran most of the jobs, to explain the change in person. Their questions about connecting from conferences abroad led to clear VPN instructions being added to the group's wiki before the restriction took effect.
32.6 Translating
Lucas practises explaining "risky sign-in followed by forwarding rule" as "someone else logged in as the student and set the mailbox to copy their mail elsewhere".
The plain version avoids "sign-in", "forwarding rule" and "compromise" without losing accuracy. Lucas tests it on a friend outside computing. If she can repeat the meaning, the translation works. He keeps a short glossary of such translations for common alert types. Translation also works in reverse: when the professor asked whether "the data got out", Lucas confirmed which data, to where and when, before answering, so his reply addressed the real question.
32.7 Joint procedures
A shared procedure lists who is informed for each incident type, within what time and through which channel.
For a personal data exposure, Riverton's procedure says the SOC informs the DPO within four hours by phone and follows up in writing. For a research system incident, the group's head and the data owner are told the same day. Agreeing these in advance removes guesswork during an incident. The procedure is reviewed at the termly meetings with partner offices, and changes are dated. During an incident, nobody has to remember who should be called; they read the table and act.
Regular contact
The SOC meets each partner office once a term, not only during incidents. Knowing people beforehand makes urgent calls easier and faster, and lets each side explain its constraints when nothing is on fire.
Worked example
For the research server case, Lucas prepares two summaries: a technical one for the research group's IT contact and a plain one for the professor and the data owner. The professor's main question is whether participants' data left the server; Lucas answers directly: no, only the shared public dataset was transferred.
Synthetic case. Procedures and summaries are invented.
Errors and limits
Different disciplines may disagree; escalate disagreements to Dr. Kim rather than deciding alone.
Exercises
- EX094 — Staff misconduct. What does the SOC do if an incident suggests staff misconduct? Rubric: 3 = pass facts to HR; do not investigate person beyond security question; 2 = partial; 1 = investigate; 0 = none.
- EX095 — Translation. Translate "risky sign-in followed by forwarding rule" for a non-technical reader. Rubric: 3 = someone else logged in and set mail to copy elsewhere; 2 = partial; 1 = jargon; 0 = none.
- EX096 — Professor's question. What did the professor most want to know, and what was the answer? Rubric: 3 = whether participant data left; no, only public dataset; 2 = partial; 1 = vague; 0 = none.
Synthesis
SOC work succeeds through other disciplines; translate findings, respect their duties and agree procedures in advance.
Continue studying — chapter 32 of 40
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →