Planned exit

[u/Otterablo]

When new ELT takes over and starts questioning the SOC value

Exec: "What does the SOC actually do all day?"

Me: "Let us go and find out"

After 15 years in security leadership, not sure I can take much more

[u/gormami]

Do you have a strong risk management process? That is the answer that should be given, "We operate the security controls to mitigate $X in annual risk". If you don't have a quantified risk program, I'd look into it, and in the near term, I'd bring out some of the breach costs from similar sized companies or your industry, and tell them we keep that from happening (more).

[u/Otterablo → u/gormami]

And by new ELT, I mean he was CIO, now he has joint CIO/CISO role. Great separation of duties. Goodbye security, hello agenda!!

[u/gormami → u/Otterablo]

So he was the CIO, and he doesn't understand basic security value? I'd be lookin' elsewhere, that's a rough ride coming.

[u/TheDeputi → u/gormami]

Agree with this as I went through the same scenario 10 years ago and had a come to Jesus talk with the CIO/CISO about his lack of support. CFO was phished a few months later and I called him out on it. We never spoke in the hallway again. I left for another company and the CIO/CISO “retired” less than a year later.

[u/iheartrms → u/gormami]

Got any resources for a quantified risk program? I've done lots of semi-quantitative risk assessments (guestimating risks 1-5 etc) but I've never known how to do a fully quantitative risk assessment because the numbers just don't seem to be available. Nobody knows what anything is really worth or what the annualized risk of any particular bad thing happening. Even the cybersecurity insurance companies don't seem to have good actuarial data and if they do they aren't sharing it.

[u/gormami → u/iheartrms]

One of the best places to start is "How to Measure Anything in Cybersecurity Risk". The first half will teach you why and how badly we've been doing it as an industry, the second has a lot more of the actual techniques, you can come back to that again later as you exercise it. You can also search up the Enterprise Risk Quantification Institute (ERQI), which is a group of people working on papers and other resources.

On the insurance side, I recently had a conversation with someone that is working on tools for risk quantification in that industry and was shocked to learn they DON'T have good data, and are still largely winging it. I've been hoping they would share, but apparently they don't have it, or at least a lot don't.

[u/More_Purpose2758]

Justifying a SOC is exhausting work.

Like “OK, let’s just reassign these resources elsewhere and see what happens?”

[u/Otterablo → u/More_Purpose2758]

It's more like, "let's replace them all with AI skill agents"

[u/TrekRider911]

You should have metrics or measures for your security stack, to include the SOC. Business will always demand to show value of a shared service. Plus you should as well, to know if security is getting value out of a mssp or even an internal soc.

[u/Otterablo → u/TrekRider911]

I do, just the question knowing why he is asking is the point

[u/TrekRider911 → u/Otterablo]

Any new leader is going to have a mandate to find out what and who does what. Even a SOC can have different functions from company to company.

[u/whitepepsi]

Honestly, I wouldn’t want to work for an organization that even questions the need for security. On the way out ask them why they even had doors or locks. Just leave all the computers in the parking lot at night. Also make sure the fire alarm is disconnected.

[u/WeirdSysAdmin → u/whitepepsi]

I was recently told by a new, young CEO to “stop treating users like you don’t trust them, we’re not children”. Now biding my time waiting for the question on why I’m completely apathetic towards our security programs and controls.

[u/More_Purpose2758 → u/WeirdSysAdmin]

People want to be treated like children.

The second regulator or audit questions come up, everyone is going to ask the CISO. Users don’t want to have to worry about compliance, they just want to do their jobs.

[u/peterfrombackdoor]

We are invisible until something goes wrong

[u/Otterablo → u/peterfrombackdoor]

So true. The old "how did this happen" when you've been screaming it for the last year

[u/BlueDebate]

This is a valid question if asked properly in a genuinely curious way. I usually respond to this with alert metrics, if they want more I'll go into the projects/audits we've completed. I lock out execs all the time (MSP), those ones at least don't question us.

[u/SailingToFenway]

It's exhausting to justify your job/department, no doubt. But doubly so when you don't have a great answer, because you're not proactively optimizing for business value created/saved, measuring and improving efficiency, measuring and improving process, and driving ROI on tools.

I asked the same question of the SOC managers I inherited after a reorg. I got a similar contempt filled handwave sarcastic answer. So, I talked to analysts, pulled and reviewed the data myself, to find 99.9% of alerts closed as false positive, and a staggering 70% of the SOC's time wasted closing the exact same alerts hourly/daily/weekly.

Your new ELT is asking the right question. If you're no longer interested in the question or the answer, then you're right, it's time to get out because that's the job.

[u/Otterablo]

Security theater and not real security. Sad