Modern Security Operations Center, The

by Joseph Muñiz

The Industry Standard, Vendor-Neutral Guide to Managing SOCs and Delivering SOC Services This completely new, vendor-neutral guide brings together all the knowledge you need to build, maintain, and operate a modern Security Operations Center (SOC) and deliver security services as efficiently and cost-effectively as possible. Leading security architect Joseph Muniz helps you assess current capabilities, align your SOC to your business, and plan a new SOC or evolve an existing one. He covers people, process, and technology; explores each key service handled by mature SOCs; and offers expert guidance for managing risk, vulnerabilities, and compliance. Throughout, hands-on examples show how advanced red and blue teams execute and defend against real-world exploits using tools like Kali Linux and Ansible. Muniz concludes by previewing the future of SOCs, including Secure Access Service Edge (SASE) cloud technologies and increasingly sophisticated automation. This guide will be indispensable for everyone responsible for delivering security services―managers and cybersecurity professionals alike. Address core business and operational requirements, including sponsorship, management, policies, procedures, workspaces, staffing, and technology Identify, recruit, interview, onboard, and grow an outstanding SOC team Thoughtfully decide what to outsource and what to insource Collect, centralize, and use both internal data and external threat intelligence Quickly and efficiently hunt threats, respond to incidents, and investigate artifacts Reduce future risk by improving incident recovery and vulnerability management Apply orchestration and automation effectively, without just throwing money at them Position yourself today for emerging SOC technologies

752 pages, Paperback

Published May 6, 2021

Reviews

[Jonathan Price · Rating 2 out of 5]

This reads like it was written by ChatGPT asked to be as verbose as possible. It's about 80% fluff, repetitive to the degree of repeating entire sections across multiple chapters, and with a maddening amount of sections that seem to just exist to fill space. Why are you spending time defining what JSON is? It's not even modern; I read far more than I needed to about how to physically lay out SOC analyst desks from a book that came out over a year into the post COVID, WFH world.

I learned nothing from this book and took far too long doing it. Honestly, this would be an okay book for an undergrad who has no idea what's going on and just needs exposure to a lot of security-ish concepts. But if you know anything about security generally, security operations or incident response specifically, don't waste your time.