Michael talks to RoseAnn Guttierrez, Technical Enablement Specialist BM at IBM
By Michael Morris, Director of Global Business Development, Endace
We have all heard horror stories about how SOC teams are overwhelmed and facing a never-ending battle against threat actors. And we all recognize it is not a matter of IF but WHEN you get breached.
So, when the worst happens is your team resilient enough and sufficiently trained to respond effectively ? Are you confident your team can determine, for certain, whether critical data, such as customer information, or systems have been compromised so you can meet all the necessary compliance and reporting obligations? And do you have the network forensics in place that your SOC needs to be able to thoroughly investigate and respond to a breach?
In this episode of the Endace Packet Forensic files, I talk with RoseAnn Guttierrez, Technical Enablement Specialist BM at IBM Security and a former SOC analyst.
Rose shares her experience of what a day in the life of a SOC engineer is really like. She discusses the best practices she and her team put in place to manage the day-to-day challenges and improve their security posture. She also highlights some of the tools that were most valued in their daily operations and the critical importance of interoperability and integrated workflows to ensure efficiency and simplicity for SOC teams.
Rose discussed the challenge of balancing the need to provide reactive incident response versus having the time to devote to more proactive threat-hunting activities and suggests some approaches to better manage the balance between these important tasks. And she provides some suggestions and recommendations for SOCs on how to build maturity into processes, training, and effectiveness to improve security investigation capability.
Rose’s combination of SOC experience and deep knowledge of the security landscape has given her unique insight into the importance of having an interoperable ecosystem of tools and vendors that enables SOC teams to build resiliency and efficiency into their DNA.
Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.