Chapter 1 — Security operations for working professionals
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 What the function does"]
N3["1.3 Models"]
N4["1.4 Mission and scope"]
N5["1.5 Frameworks"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 What the function does"]
N3["1.3 Models"]
N4["1.4 Mission and scope"]
N5["1.5 Frameworks"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 What the function does]
|
v
[1.3 Models]
|
v
[1.4 Mission and scope]
|
v
[1.5 Frameworks]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain what a security operations function does in a mid-sized organisation; (2) decide between in-house, outsourced and hybrid models; (3) set a mission and scope; (4) introduce the course case.
1.1 The case
Priya Nair is IT manager at the fictional Fenwick Engineering, a 200-person maker of pump components with design offices and a factory floor. On a Tuesday night in March, an alert from the VPN shows IT technician j.harper logging in at 22:41 from a country he has never visited. Within minutes his account joins the Domain Admins group and reads 2,310 design files. Fenwick has no SOC; the alert went to a shared mailbox that nobody watched at night. Priya finds it the next morning. Her board asks her to build a security operations function, and she enrols on this six-month course to do it well.
1.2 What the function does
A security operations function watches for signs of attack, decides which matter, and coordinates the response. Zimmerman's "Ten Strategies of a World-Class Cybersecurity Operations Center" (MITRE, 2014) and its successor, Knerler, Parker and Zimmerman's "11 Strategies" (MITRE, 2022), both stress that a SOC first needs a clear mission, authority and a defined constituency, before tools. For Fenwick, the March event showed all three parts missing: an alert fired, but nobody watched for it, decided it mattered or coordinated a response. Priya starts with mission and authority for that reason, before choosing tools or a provider.
1.3 Models
In-house gives control and knowledge of the business but costs staff and 24-hour cover. Outsourcing to a managed security service gives night cover and tools but less context. A hybrid keeps an in-house lead who owns decisions while a provider watches out of hours. Fenwick, with no security staff, chooses hybrid. Fenwick cannot afford round-the-clock in-house staff, but March showed that night cover matters. The hybrid lets a provider answer alerts at night while Priya keeps decisions about Fenwick's business, such as when to isolate a factory PC. Her board paper explains this choice with the costs of each model.
1.4 Mission and scope
Priya's draft mission: "Detect and respond to threats against Fenwick's design data, production systems and staff accounts, around the clock, with in-house ownership of decisions." Scope includes offices, the VPN, cloud email and the factory's supervisory PCs, but not the machine controllers themselves, which the vendor manages. The mission names the assets March threatened: design data and staff accounts, plus production systems that keep the factory running. Excluding the machine controllers is honest about what Fenwick can monitor, since the vendor manages them. Priya records the exclusion and the vendor's responsibility, so the board knows the gap exists. The scope is reviewed each year with the charter, so a change such as the vendor handing over controller management would bring them into monitoring.
1.5 Frameworks
NIST CSF 2.0 (CSWP 29, 2024) gives a shared language for outcomes; NIST SP 800-61r3 (Nelson et al., 2025) frames incident response within it. Priya uses both to explain the plan to the board. The board does not need technical detail, but it needs to see that the plan follows recognised practice. Using CSF 2.0 outcomes, Priya can show which parts of the plan detect, which respond and which govern. SP 800-61r3 shapes the response plan written later in the year. Both documents are public, so the board and the provider can read the same references, and the provider already uses CSF terms in its own reports, which makes monthly reviews easier.
Worked example
Priya's board paper explains the March event in four lines, proposes a hybrid model with a provider covering 18:00–08:00 and weekends, names herself as SOC owner with one new analyst hire, and lists three first-year goals: log coverage, a tested response plan and alert handling within 30 minutes at any hour.
Synthetic case. Fenwick Engineering, its staff and events are invented.
Errors and limits
A hybrid model fails if the provider and in-house team do not share context; chapter 6 deals with this.
Exercises
- EX001 — The trigger. What did the March alert show? Rubric: 3 = 22:41 new-country VPN login; Domain Admins; 2,310 files read; unwatched mailbox; 2 = partial; 1 = one; 0 = none.
- EX002 — Model choice. Why did Fenwick choose a hybrid model? Rubric: 3 = no security staff; needs night cover; keep ownership in-house; 2 = partial; 1 = vague; 0 = none.
- EX003 — Mission parts. What does Priya's mission statement cover? Rubric: 3 = design data, production systems, staff accounts; around clock; in-house decisions; 2 = partial; 1 = vague; 0 = none.
- EX004 — Out of scope. What is out of scope and why? Rubric: 3 = machine controllers; vendor-managed; 2 = partial; 1 = vague; 0 = none.
- EX005 — First-year goals. List the three first-year goals. Rubric: 3 = log coverage; tested response plan; 30-minute alert handling; 2 = two; 1 = one; 0 = none.
Synthesis
Start with mission, scope and model before buying tools.