CSOC Security Operations Procedures

Question 1

What is the primary function of a Cybersecurity Operations Centre (CSOC)?

Accepted Answer

To continuously monitor an organisation's IT environment for threats, detect security incidents, and coordinate response activities

Answer

To develop and maintain the organisation's cybersecurity policies and standards

Answer

To manage all IT infrastructure including servers, networks, and end-user devices

Answer

To conduct penetration tests and vulnerability assessments on a scheduled basis

Question 2

What does 'triage' mean in CSOC operations?

Accepted Answer

The process of evaluating and prioritising security alerts and incidents based on their severity, potential impact, and urgency

Answer

The process of removing compromised systems from the network

Answer

The initial step of documenting a security incident in the incident management system

Answer

The process of notifying affected stakeholders after a security breach is confirmed

Question 3

What is an escalation matrix in CSOC operations?

Accepted Answer

A defined structure that specifies who should be notified and when, based on the severity of a security incident

Answer

A rating system for scoring the technical severity of different types of cyber attacks

Answer

A framework for escalating security staff to senior positions based on performance

Answer

A document listing all external agencies that must be notified during a national cyber emergency

Question 4

What is the significance of maintaining accurate and detailed incident tickets in CSOC operations?

Accepted Answer

Incident tickets provide a traceable record of all actions taken, support analysis and reporting, and ensure continuity when different analysts handle the same incident

Answer

Incident tickets are primarily for billing purposes to charge client organisations for response time

Answer

Incident tickets are required only for incidents that result in a formal police report

Answer

Incident tickets are reviewed only during annual audits and have no operational significance

Question 5

What is 'shift handover' in a 24/7 CSOC and what information should it include?

Accepted Answer

The structured transfer of situational awareness between outgoing and incoming shift teams, covering active incidents, monitoring status, and any pending actions

Answer

The handover of physical security access cards and building keys between security shifts

Answer

A formal end-of-day meeting where all CSOC staff present their individual work logs

Answer

A system where different analysts are assigned to different monitoring systems each shift

Question 6

Why is documentation of Standard Operating Procedures (SOPs) important in a CSOC?

Accepted Answer

SOPs ensure consistent and repeatable responses to common scenarios, reduce reliance on individual knowledge, and support training of new staff

Answer

SOPs are required by Singapore law as a condition of operating a CSOC facility

Answer

SOPs eliminate the need for analyst judgment by prescribing a fixed response to every scenario

Answer

SOPs are primarily useful for external audits and have limited day-to-day operational value