Chapter 1 — Security operations in one month: seeing what matters
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 What security operations means"]
N3["1.3 What to protect"]
N4["1.4 A few good signals"]
N5["1.5 Who watches, who acts"]
N6["1.6 Frameworks in plain words"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 What security operations means"]
N3["1.3 What to protect"]
N4["1.4 A few good signals"]
N5["1.5 Who watches, who acts"]
N6["1.6 Frameworks in plain words"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 What security operations means]
|
v
[1.3 What to protect]
|
v
[1.4 A few good signals]
|
v
[1.5 Who watches, who acts]
|
v
[1.6 Frameworks in plain words]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain what security operations means for a small organisation; (2) identify the few signals worth watching; (3) set up who watches and who acts; (4) introduce the case.
1.1 The case
Leo Barros is office manager at the fictional Marlow & Finch, a 12-person accountancy. IT is handled by a small outside support company, BrightPath IT. On a Monday morning, a client phones to ask why partner Elaine Finch emailed asking them to pay an invoice into a new bank account. Elaine sent no such email. Leo has one month, with this rapid course, to set up basic security operations so the firm notices such things itself.
The client's phone call is the only reason anyone found out. Nothing at the firm raised an alarm: no one watched sign-ins, and a hidden mailbox rule kept the clients' replies away from Elaine.
1.2 What security operations means
Security operations is the routine of watching for signs of attack, deciding what matters and acting quickly. Large firms run a security operations centre (SOC); small firms need the same habits on a small scale. MITRE's "11 Strategies of a World-Class Cybersecurity Operations Center" (Knerler, Parker and Zimmerman, 2022) starts with knowing what you protect and who has authority, which applies to a 12-person firm as much as to a bank.
For Leo, "knowing what you protect" means the client data and mailboxes, and "authority" means deciding in advance who may lock an account at 10 on a Monday morning without waiting for a partners' meeting. In this case that delay would have mattered: one client paid £4,800 into the criminal's account that morning.
1.3 What to protect
For Marlow & Finch: client financial data, email accounts (because criminals use them for invoice fraud) and the accounts software. Email matters most because it is how money is requested.
Leo ranks email first because of what happened to Elaine: one mailbox, accessed with one stolen password, was enough to send a fake invoice to two clients and hide the replies. The client data and accounts software matter too, but an attack on them would most likely start with a mailbox like hers. So most of the plan protects and watches the email accounts.
1.4 A few good signals
A small firm cannot watch everything. Leo picks four signals: sign-ins from unusual countries or at night, new mailbox forwarding rules, multi-factor authentication (MFA) changes, and staff reports of odd emails. These cover the most common ways small firms are attacked.
Each signal matches part of Elaine's incident. The criminal signed in at night from Brazil, set up a forwarding rule four minutes later, and worked on an account without MFA. The fraud was spotted only because a client phoned with an odd email. With these four signals in place, the forwarding rule alone would have produced an alert on Friday night, before any client paid.
1.5 Who watches, who acts
BrightPath IT receives security alerts from the email service and calls Leo for anything urgent. Leo can ask BrightPath to reset passwords and block sign-ins at any hour; partners are told afterwards. This is written on one page and signed by both partners.
The page also answers the question that slows small firms down: who may lock a partner out of her own mailbox? Leo may, and the partners learn afterwards. On the Monday of the fraud, Leo approved the actions at 10:05, and BrightPath had revoked Elaine's sessions three minutes later. Without the signed page, Leo would have needed to reach both partners first.
1.6 Frameworks in plain words
NIST CSF 2.0 (CSWP 29, 2024) groups security work into Govern, Identify, Protect, Detect, Respond and Recover. Leo's plan touches each: a signed page (Govern), knowing what matters (Identify), MFA (Protect), the four signals (Detect), the call list (Respond) and backups (Recover).
The framework does not add work; it checks for gaps. Before the incident, Marlow & Finch had no MFA, no alerts and no call list, so Protect, Detect and Respond were empty. Using the six words as a checklist showed Leo that his plan needed something in each, and that backups, for Recover, were the only part already in place.
Worked example
Leo's one-page plan: protect email, client data and accounts software; watch four signals; BrightPath watches and calls Leo; Leo may approve resets and blocks at any time; the partners review monthly. Elaine signs it and asks for the fraud to be investigated first.
Synthetic case. Marlow & Finch, BrightPath IT and all events are invented.
Errors and limits
Four signals will not catch everything; they target the most likely problems.
Exercises
- EX001 — Monday call. What did the client's call reveal? Rubric: 3 = email from Elaine asking payment to new bank account; she did not send it; 2 = partial; 1 = vague; 0 = none.
- EX002 — Security operations meaning. Define security operations in one sentence. Rubric: 3 = watch, decide, act quickly; 2 = partial; 1 = vague; 0 = none.
- EX003 — Most important asset. Why does email matter most here? Rubric: 3 = criminals use it to request money; 2 = partial; 1 = vague; 0 = none.
- EX004 — Four signals. List Leo's four signals. Rubric: 3 = unusual sign-ins; forwarding rules; MFA changes; staff reports; 2 = three; 1 = one; 0 = none.
- EX005 — Watcher. Who watches alerts and who approves actions? Rubric: 3 = BrightPath watches; Leo approves; 2 = partial; 1 = vague; 0 = none.
- EX006 — Night authority. Can Leo act before telling partners? Rubric: 3 = yes; partners told afterwards; 2 = partial; 1 = vague; 0 = none.
- EX007 — CSF mapping. Map MFA and backups to CSF functions. Rubric: 3 = MFA Protect; backups Recover; 2 = one; 1 = vague; 0 = none.
- EX008 — Plan length. Why keep the plan to one page? Rubric: 3 = people read and use it; 2 = partial; 1 = vague; 0 = none.
- EX009 — Signal limits. What is the limit of four signals? Rubric: 3 = won't catch everything; 2 = partial; 1 = vague; 0 = none.
- EX010 — Partner review. How often do the partners review? Rubric: 3 = monthly; 2 = one; 1 = vague; 0 = none.
- EX011 — 11 Strategies lesson. Which idea from the 11 Strategies applies to a small firm? Rubric: 3 = know what you protect and who has authority; 2 = partial; 1 = vague; 0 = none.
- EX012 — First task. What did Elaine ask to be done first? Rubric: 3 = investigate the fraud; 2 = partial; 1 = vague; 0 = none.
- EX013 — Protected items. Name the three things to protect. Rubric: 3 = client data, email, accounts software; 2 = two; 1 = one; 0 = none.
Synthesis
Small firms need the same habits as a SOC: know what matters, watch a few good signals and agree who acts.