Chapter 10 — Security operations and blue team: orientation | Technologist Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 10 — Security operations and blue team: orientation

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 A managed SOC"]
  N2["10.2 Workflow"]
  N3["10.3 Authority"]
  N4["10.4 Frameworks"]
  N5["10.5 Roles"]
  N6["10.6 Service levels"]
  N7["10.7 Mei's role"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 A managed SOC"]
  N2["10.2 Workflow"]
  N3["10.3 Authority"]
  N4["10.4 Frameworks"]
  N5["10.5 Roles"]
  N6["10.6 Service levels"]
  N7["10.7 Mei's role"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 A managed SOC]
    |
    v
[10.2 Workflow]
    |
    v
[10.3 Authority]
    |
    v
[10.4 Frameworks]
    |
    v
[10.5 Roles]
    |
    v
[10.6 Service levels]
    |
    v
[10.7 Mei's role]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) describe what a managed SOC does for small clients; (2) explain the SOC workflow from alert to closure; (3) relate SOC work to NIST CSF 2.0 and SP 800-61r3; (4) understand roles and service agreements.

10.1 A managed SOC

Copperleaf provides monitoring, triage, investigation and response guidance to clients that cannot run their own SOC. It operates under service agreements that define what is monitored, response times and what Copperleaf may do on clients' systems.

For BrightSmile this means Copperleaf watches the clinic servers and PCs through its agent and the firewall logs, triages what the rules raise and tells the office manager what to do. It does not run the clinic's IT; changes to the firewall or the hypervisor remain the IT contractor's work, carried out on Copperleaf's advice.

10.2 Workflow

Logs flow into the SIEM; rules raise alerts; analysts triage, investigate and either close, advise the client or act under agreed authority; every step is recorded in the case system.

The BrightSmile alert on the incident night followed exactly this path. The server's events reached the SIEM, the new-administrator rule raised an alert, Mei triaged it, Raj approved containment, and Copperleaf isolated the server and disabled two accounts. Each of those steps has an entry in the case system with a time and a name, which later lets the team rebuild the night exactly.

10.3 Authority

Copperleaf may isolate an endpoint through its agent and disable accounts it manages, but only for alert types and clients where the agreement allows. Other actions are advised, not taken.

Under BrightSmile's agreement, isolating an endpoint and disabling local accounts were permitted, so Copperleaf could act on CLINIC2-SRV at night without waiting for the morning. Changing the firewall's forwarding rule was not, so closing port 3389 was advised to the contractor instead. Mei checks the agreement first because a client with different terms may allow only advice.

10.4 Frameworks

NIST CSF 2.0 organises outcomes into Govern, Identify, Protect, Detect, Respond and Recover; Copperleaf mainly delivers Detect and Respond. NIST SP 800-61r3 frames incident response within risk management and continuous improvement.

The BrightSmile incident night maps onto those six functions quite directly. Detect covers the new-administrator alert, Respond covers isolation and account disabling, and Recover covers restoring files and service the next day. Govern and Identify still matter, because Mei's inventory and the client agreement belong there, but they are mostly the client's responsibility with Copperleaf's advice.

10.5 Roles

Tier-1 analysts triage; senior analysts investigate; Raj leads and approves containment; client contacts receive advice and make business decisions.

On the BrightSmile night, Mei triaged as the analyst on shift, Raj approved containment as lead, and the office manager decided to keep the clinic closed until the morning review. Each decision sat with the person entitled to make it. Separating these roles keeps a trainee from taking actions alone and keeps business choices with the client. Clear roles also matter at handover, because the next shift can see in the case system who approved which action and why.

10.6 Service levels

High-severity alerts are acknowledged within 15 minutes, 24 hours a day.

Fifteen minutes is short because of how fast the early steps move. On CLINIC2-SRV only three minutes passed between the reception logon at 01:19 and the creation of support2 at 01:22, so an alert left waiting until the morning would arrive after the damage. Acknowledgement starts the clock on investigation; it does not mean the alert is resolved. The service level applies at night as well, which is why Copperleaf keeps an analyst on shift and a lead reachable by phone around the clock.

10.7 Mei's role

As a trainee, Mei triages under supervision and drafts client advice for Raj's review.

Supervision means Mei's decisions are checked before they reach a client. She can triage an alert and propose closing it, but a containment action or a message to BrightSmile goes through Raj first. Her drafts on the incident night, such as the incident note, were reviewed by him before anything was sent to the office manager. Raj's review also teaches, because each correction to a draft shows Mei what a client needs to read and what can be left out.

Communication with clients

Clients get plain messages: what happened, what Copperleaf did, what the client should do and when the next update will come. Technical detail goes in an attachment for their IT contractor.

Worked example

For the BrightSmile incident, the agreement allowed Copperleaf to isolate endpoints and disable local accounts. Raj approved isolating CLINIC2-SRV at 01:36 and disabling support2 and reception. The office manager was called at 01:40 and agreed to keep the clinic closed until the morning review.

Synthetic case. Agreements and events are invented.

Errors and limits

Agreements vary by client; always check before acting.

Exercises

EX028 — Authority limits. What determines what Copperleaf may do on a client system? Rubric: 3 = service agreement by client and alert type; 2 = partial; 1 = anything; 0 = none.
EX029 — CSF functions. Which CSF functions does Copperleaf mainly deliver? Rubric: 3 = Detect and Respond; 2 = one; 1 = wrong; 0 = none.
EX030 — BrightSmile actions. What actions were taken at BrightSmile and when? Rubric: 3 = server isolated 01:36, accounts disabled, manager called 01:40; 2 = partial; 1 = vague; 0 = none.

Synthesis

A managed SOC works within agreements and frameworks, turning alerts into recorded, authorised actions.

Continue studying — chapter 10 of 30

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →