At Recon InfoSec we have the honor of working with some of the best security operations, incident response, and threat hunting teams in the world: Fortune 100 companies, military cyber protection teams, global incident response firms, “3 letter agencies,” and “Big 4” professional services companies.
We have completed thousands of hours training these teams, and our experience shows us that nearly all security operations teams commit time and resources to training. But, the primary factor which distinguishes great teams is how they train.
Great security operations teams:
The growing challenge facing the Information Security community and the corresponding talent shortage are widely recognized. Nowhere is this more acute than in security operations centers and incident response teams.
Given these challenges, what is the best way to make these teams better? Is it more classes? More certificates? More labs and workshops? More Red vs. Blue capture-the-flag games? There is a bewildering catalog of offerings from an industry that is well known for its smoke and mirrors.
Many teams take an “all training is good training” approach. Unfortunately, this leads to the all-too-common feeling that they are spending a lot on training and certifications but not getting any better at security operations.. Enterprise Security is notoriously broad, complex and dynamic. There are literally hundreds of topics, tools, and techniques that are relevant. But how much of it leads to measurable improvements in team performance? Do all training dollars produce the same benefit? Are traditional classes more valuable than hands-on workshops? Is there more benefit to a set of labs or a new certificate? What role does on-the-job training have? What knowledge should be required of new hires? What knowledge should be developed in-house?
The core of information security operations, incident response, and threat hunting is practical, technical problem solving. It is practical because incidents require analysts with hands-on skills. It is technical in that it requires extensive, specialized knowledge.
For great teams, Knowledge, Skills, and Operational Capabilities are important and necessary, but they differ significantly in how they are developed, when they are developed, and their overall value to the organization. The model below captures the relationship between the three.
Knowledge is what we understand.
Skills are what we can do.
Operational Capabilities are the problems we can solve.
This 3 layer model is exceptionally valuable in diagnosing training needs, developing training plans, and allocating training resources.
So how do the best security operations teams approach training? Do they invest in more classes? Do they host more workshops and labs? Do they establish good mentoring programs, structure on the job training, and run regular range exercises? The short answer is yes, they do all those things.
But it is more insightful to note that they only do those things when they have identified specific deficiencies in their Operational Capability tied directly to those activities. Operational Capability is the value the security operations team brings to their organization, it is the goal of their daily operations, and it is the measure of the effectiveness of their training programs.
They don’t invest in classes for the sake of certifications. They only invest in classroom training when the team has knowledge deficiencies that are limiting their Operational Capabilities. They regularly invest time and money in workshops and labs to build skills that have demonstrated utility. Most importantly, they realize the best way to improve Operational Capability is proactively, through experience.
Having run the Recon Network Defense Range for hundreds of the best incident responders and threat hunters around the world has taught us the importance of focusing on Operational Capability and team experience. We design all of our courses and Range Days around those objectives, focus our internal training this way, and we would encourage all security operations teams to do the same.
The best security operations teams focus their training budgets on mentoring, on-the-job-training, and high-fidelity simulations. Not only does experience build and improve Operational Capability, but it also helps assess the gaps in both knowledge and skills proactively.
To optimize your security operations: