We do not run security operations centres, and we do not sell monitoring. What we do, from the assessor’s and the former operator’s side, is help an organisation specify what it needs to watch, who should react, and what the procedures say. This is the one time we did that from inside, as a group’s acting CISO, and what it taught us about the first three months.
The starting point
A manufacturing group with more than twenty plants received its security alerts by email. The antivirus was the only source. A small corporate team in one country read the mailbox in office hours. An alert raised at six in the evening on a Friday was read on Monday. Three intrusion waves in six months had made the gap obvious.
What was specified, and in what order
Sources first, tools second. Two sources that already existed and nobody was reading: the antivirus console and the domain controllers’ security events, collected by a log platform the group already ran. Later, a vulnerability platform and endpoint detection were added. Nothing was bought for the desk itself.
One channel, pushed, not pulled. Alerts from both sources went to a shared chat channel, not a mailbox. A channel is read; a mailbox is filed.
Four priorities and a playbook for each. P1 to P4, with a one-page playbook per priority saying who is called, within what time, and what the first three actions are. The playbooks were written by the people who would run them, and corrected after the first real event.
Follow the sun with the people you have. The group had IT staff on three continents. First-line triage rotated across them by time zone, so that the channel always had someone awake reading it. The Americas team turned out to be the most active, which nobody had predicted.
A weekly report. One page: events by priority, by site, by source, and the trend. The trend is what the executive committee read.
What it produced
By the end of the first year the desk handled around fifty events a month. Four in a hundred were P1. About twenty a month needed a qualified technician. Almost nothing was left unhandled. When the ransomware attack came, hundreds of alerts hit the channel in a few hours, and the first reaction, the decision to cut the links, was taken within four hours because people were awake and reading.
What it could not do
This was a first-line desk, and it is important to say what that means. There was no second-line on-call, no second-line service levels, and few data sources. It could notice and react. It could not investigate deeply, and it could not see what its two sources did not show. The attack it noticed was one the sources happened to cover. The next step, specified but not yet built when the attack came, was a proper event platform and endpoint detection, with second-line procedures, before any decision about external expertise.
What people get wrong
They assume round-the-clock detection means an expensive managed service on day one. The first three months are about spreading triage across the people you already employ and writing down who does what.
They assume the reverse: that a cheap first-line desk is enough. It buys reaction time. It does not buy investigation, and it does not buy coverage of what you are not collecting.
They buy the platform before the playbooks. A platform with no one assigned to its alerts is a mailbox with a dashboard.
A platform with no one assigned to its alerts is a mailbox with a dashboard.