Watching without crying wolf

Security operations is the ongoing work of watching for signs of an attack, deciding whether something is real, and responding when it is.

The central difficulty is noise. A network produces an enormous number of events and almost all of them are normal. A system alerting on everything unusual produces hundreds of alerts a day, every one of which has to be looked at by somebody, and within two weeks they are all being closed without investigation. That is the failure mode of most security monitoring, and the organisation then has a tool, a cost, and no detection.

So the work is not collecting more data. It is deciding what genuinely indicates a problem, tuning out what does not, and making sure the small number of real alerts get attention.

What is actually watched. Failed and unusual sign ins. New administrative accounts. Access at unusual times or from unusual places. Large data transfers. Malware detections. Changes to critical configuration. And connections to known bad destinations.

In a small organisation, this is one person's part time responsibility rather than a team, and that is fine provided the few things being watched are the right ones and somebody actually looks.

The realistic goal for most organisations here is not a security operations centre. It is: know when somebody signs in from another country, know when an administrative account is created, keep the logs long enough to investigate, and have a plan for what to do.