CSOC Security Operations Procedures — Questions and Answers
Question 1: What is the primary function of a Cybersecurity Operations Centre (CSOC)?
- To continuously monitor an organisation's IT environment for threats, detect security incidents, and coordinate response activities (Correct answer)
- To develop and maintain the organisation's cybersecurity policies and standards
- To manage all IT infrastructure including servers, networks, and end-user devices
- To conduct penetration tests and vulnerability assessments on a scheduled basis
Correct answer: To continuously monitor an organisation's IT environment for threats, detect security incidents, and coordinate response activities
A CSOC is dedicated to 24/7 monitoring of an organisation's security environment, detecting and analysing threats, and coordinating incident response. It serves as the central hub for operational cybersecurity activities.
Question 2: What does 'triage' mean in CSOC operations?
- The process of evaluating and prioritising security alerts and incidents based on their severity, potential impact, and urgency (Correct answer)
- The process of removing compromised systems from the network
- The initial step of documenting a security incident in the incident management system
- The process of notifying affected stakeholders after a security breach is confirmed
Correct answer: The process of evaluating and prioritising security alerts and incidents based on their severity, potential impact, and urgency
Triage in a CSOC involves assessing incoming alerts to determine their validity, severity, and required response priority. Given the volume of alerts, effective triage is essential to ensure that the most serious threats receive immediate attention.
Question 3: What is an escalation matrix in CSOC operations?
- A defined structure that specifies who should be notified and when, based on the severity of a security incident (Correct answer)
- A rating system for scoring the technical severity of different types of cyber attacks
- A framework for escalating security staff to senior positions based on performance
- A document listing all external agencies that must be notified during a national cyber emergency
Correct answer: A defined structure that specifies who should be notified and when, based on the severity of a security incident
An escalation matrix defines the chain of notification for security incidents, specifying which individuals or teams must be notified at different severity levels and within what timeframes. It ensures the right people are informed at the right time.
Question 4: What is the significance of maintaining accurate and detailed incident tickets in CSOC operations?
- Incident tickets provide a traceable record of all actions taken, support analysis and reporting, and ensure continuity when different analysts handle the same incident (Correct answer)
- Incident tickets are primarily for billing purposes to charge client organisations for response time
- Incident tickets are required only for incidents that result in a formal police report
- Incident tickets are reviewed only during annual audits and have no operational significance
Correct answer: Incident tickets provide a traceable record of all actions taken, support analysis and reporting, and ensure continuity when different analysts handle the same incident
Incident tickets document every step of the detection, analysis, and response process. They enable handover between analysts across shifts, support post-incident reviews, provide evidence for reporting and compliance, and create an audit trail.
Question 5: What is 'shift handover' in a 24/7 CSOC and what information should it include?
- The structured transfer of situational awareness between outgoing and incoming shift teams, covering active incidents, monitoring status, and any pending actions (Correct answer)
- The handover of physical security access cards and building keys between security shifts
- A formal end-of-day meeting where all CSOC staff present their individual work logs
- A system where different analysts are assigned to different monitoring systems each shift
Correct answer: The structured transfer of situational awareness between outgoing and incoming shift teams, covering active incidents, monitoring status, and any pending actions
Shift handover ensures continuity in a 24/7 CSOC. The outgoing team briefs the incoming team on active incidents, ongoing investigations, any changes to the environment, and pending tasks, so there is no gap in situational awareness.
Question 6: Why is documentation of Standard Operating Procedures (SOPs) important in a CSOC?
- SOPs ensure consistent and repeatable responses to common scenarios, reduce reliance on individual knowledge, and support training of new staff (Correct answer)
- SOPs are required by Singapore law as a condition of operating a CSOC facility
- SOPs eliminate the need for analyst judgment by prescribing a fixed response to every scenario
- SOPs are primarily useful for external audits and have limited day-to-day operational value
Correct answer: SOPs ensure consistent and repeatable responses to common scenarios, reduce reliance on individual knowledge, and support training of new staff
SOPs standardise how the CSOC handles common situations, ensuring consistency and quality regardless of which analyst is on duty. They are also vital for training new staff and for review and improvement through post-incident analysis.
CSOC Security Operations Procedures
What is the primary function of a Cybersecurity Operations Centre (CSOC)?