{"id":29698,"date":"2019-10-15T16:00:50","date_gmt":"2019-10-15T16:00:50","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=89997"},"modified":"2019-10-15T16:00:50","modified_gmt":"2019-10-15T16:00:50","slug":"microsofts-4-principals-for-an-effective-security-operations-center","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsofts-4-principals-for-an-effective-security-operations-center\/","title":{"rendered":"Microsoft\u2019s 4 principals for an effective security operations center"},"content":{"rendered":"
<\/div>\n

The Microsoft Cyber Defense Operations Center (CDOC) fields trillions of security signals every day. How do we identify and respond to the right threats? One thing that won\u2019t surprise you: we leverage artificial intelligence (AI), machine learning, and automation to narrow the focus. But technology is not enough. Our people, culture, and process are just as critical.<\/p>\n

You may not have trillions of signals to manage, but I bet you will still get a lot of value from a behind-the-scenes look at the CDOC. Even the small companies that I\u2019ve worked with have improved the effectiveness of their security operations centers (SOCs) based on learnings from Microsoft.<\/p>\n

Watch the operations episode of the CISO Spotlight Series\u2014The people behind the cloud<\/a> to get my take and a sneak peek at our team in action. In the video, I walk you through four principals:<\/p>\n

    \n
  1. It starts with assessment.<\/li>\n
  2. Invest in the right technology.<\/li>\n
  3. Hire a diverse group of people.<\/li>\n
  4. Foster an innovative culture.<\/li>\n<\/ol>\n

    It starts with assessment<\/h3>\n

    Before you make any changes, it helps to identify the gaps in your current security system. Take a look at your most recent attacks to see if you have the right detections in place. Offense should drive your defenses. For example:<\/p>\n