1 1 00:00:00,000 --> 00:00:01,050 In this lesson, 2 2 00:00:01,050 --> 00:00:02,786 we're going to discuss standardized processes 3 3 00:00:02,786 --> 00:00:05,160 and how they can be used to improve the efficiency 4 4 00:00:05,160 --> 00:00:07,950 of your organization's security operations. 5 5 00:00:07,950 --> 00:00:10,500 Now, standardization is the process of establishing 6 6 00:00:10,500 --> 00:00:13,080 a set of consistent and repeatable guidelines, 7 7 00:00:13,080 --> 00:00:14,970 procedures and best practices 8 8 00:00:14,970 --> 00:00:16,890 for security operations. 9 9 00:00:16,890 --> 00:00:18,840 This can include standard operating procedures 10 10 00:00:18,840 --> 00:00:20,310 known as SOPs, 11 11 00:00:20,310 --> 00:00:24,240 documentation and instant response protocols or playbooks. 12 12 00:00:24,240 --> 00:00:26,578 Standardization helps to ensure the security operations 13 13 00:00:26,578 --> 00:00:29,940 are being conducted in a consistent and predictable manner, 14 14 00:00:29,940 --> 00:00:31,530 as well as a repeatable manner. 15 15 00:00:31,530 --> 00:00:33,690 And this can all help to improve efficiency 16 16 00:00:33,690 --> 00:00:34,770 and effectiveness, 17 17 00:00:34,770 --> 00:00:37,680 as well as reducing the risk of errors or omissions. 18 18 00:00:37,680 --> 00:00:39,870 Now, there are several benefits of standardization 19 19 00:00:39,870 --> 00:00:41,370 in security operations, 20 20 00:00:41,370 --> 00:00:43,050 including improved efficiency 21 21 00:00:43,050 --> 00:00:46,290 increased visibility, and enhanced collaboration. 22 22 00:00:46,290 --> 00:00:48,510 First, we have improved efficiency. 23 23 00:00:48,510 --> 00:00:51,270 By establishing consistent procedures and best practices 24 24 00:00:51,270 --> 00:00:54,330 security teams can work more efficiently and effectively. 25 25 00:00:54,330 --> 00:00:56,640 This can help lead to improved instant response times 26 26 00:00:56,640 --> 00:00:59,700 and more accurate and thorough threat detection. 27 27 00:00:59,700 --> 00:01:02,040 Second, we have increased visibility. 28 28 00:01:02,040 --> 00:01:03,630 Standardization can help to ensure 29 29 00:01:03,630 --> 00:01:06,480 that all security activities are being tracked and recorded 30 30 00:01:06,480 --> 00:01:08,250 which provides us with greater visibility 31 31 00:01:08,250 --> 00:01:10,603 into the performance of security operations. 32 32 00:01:10,603 --> 00:01:13,260 This can help to identify areas for improvement 33 33 00:01:13,260 --> 00:01:15,210 and make it easier to measure the effectiveness 34 34 00:01:15,210 --> 00:01:17,010 of your security measures. 35 35 00:01:17,010 --> 00:01:19,590 Third, we have enhanced collaboration. 36 36 00:01:19,590 --> 00:01:22,080 Standardization can help facilitate communication 37 37 00:01:22,080 --> 00:01:23,130 and collaboration 38 38 00:01:23,130 --> 00:01:24,750 between different teams and departments 39 39 00:01:24,750 --> 00:01:26,550 within your organization. 40 40 00:01:26,550 --> 00:01:29,070 This can help to improve the ability of security teams 41 41 00:01:29,070 --> 00:01:30,090 to respond to incidents 42 42 00:01:30,090 --> 00:01:31,380 and share information, 43 43 00:01:31,380 --> 00:01:33,990 which can also help to improve the overall security posture 44 44 00:01:33,990 --> 00:01:35,670 of your organization. 45 45 00:01:35,670 --> 00:01:37,680 Now, process improvement, on the other hand 46 46 00:01:37,680 --> 00:01:39,360 is considered a systematic approach 47 47 00:01:39,360 --> 00:01:42,150 to identify and eliminate waste and inefficiencies 48 48 00:01:42,150 --> 00:01:44,730 inside an organization's processes. 49 49 00:01:44,730 --> 00:01:46,468 In the context of security operations 50 50 00:01:46,468 --> 00:01:48,630 this can involve identifying bottlenecks 51 51 00:01:48,630 --> 00:01:50,280 in instant response processes, 52 52 00:01:50,280 --> 00:01:53,100 streamlining data collection and analysis procedures 53 53 00:01:53,100 --> 00:01:56,040 or improving collaboration between different teams. 54 54 00:01:56,040 --> 00:01:57,210 Process improvement methods 55 55 00:01:57,210 --> 00:02:00,390 can be used to improve the efficiency of security operations 56 56 00:02:00,390 --> 00:02:02,486 and it can help organizations meet the challenges 57 57 00:02:02,486 --> 00:02:04,950 of constantly evolving threats. 58 58 00:02:04,950 --> 00:02:06,480 Now, there are three main types 59 59 00:02:06,480 --> 00:02:08,730 of process improvement methods you should be aware of, 60 60 00:02:08,730 --> 00:02:12,450 including Six Sigma, Lean and CSI. 61 61 00:02:12,450 --> 00:02:14,370 First, we have Six Sigma. 62 62 00:02:14,370 --> 00:02:16,290 Six Sigma is one of the most widely used 63 63 00:02:16,290 --> 00:02:17,880 process improvement methods, 64 64 00:02:17,880 --> 00:02:19,434 and it's actually a data-driven methodology 65 65 00:02:19,434 --> 00:02:22,680 for improving quality and reducing defects. 66 66 00:02:22,680 --> 00:02:24,660 Six Sigma is an iterative process 67 67 00:02:24,660 --> 00:02:26,550 that involves a couple of key steps, 68 68 00:02:26,550 --> 00:02:31,050 including, define, measure, analyze, improve and control. 69 69 00:02:31,050 --> 00:02:33,280 Six sigma can be applied to security operations 70 70 00:02:33,280 --> 00:02:35,550 to help improve instant response times, 71 71 00:02:35,550 --> 00:02:36,930 reduce errors and omissions, 72 72 00:02:36,930 --> 00:02:38,370 and improve the overall efficiency 73 73 00:02:38,370 --> 00:02:40,590 of your security operations center. 74 74 00:02:40,590 --> 00:02:42,030 Another method you should be aware of 75 75 00:02:42,030 --> 00:02:44,820 is known as Lean or the Lean methodology. 76 76 00:02:44,820 --> 00:02:46,020 Now, Lean methodology 77 77 00:02:46,020 --> 00:02:48,960 focuses on minimizing waste and maximizing value 78 78 00:02:48,960 --> 00:02:50,396 in all of your processes. 79 79 00:02:50,396 --> 00:02:51,870 This method can be used 80 80 00:02:51,870 --> 00:02:53,580 to help streamline security operations centers 81 81 00:02:53,580 --> 00:02:56,760 by eliminating any unnecessary steps or procedures, 82 82 00:02:56,760 --> 00:02:58,237 and by improving the flow of information 83 83 00:02:58,237 --> 00:03:00,210 between different teams and departments 84 84 00:03:00,210 --> 00:03:01,553 in your organization. 85 85 00:03:01,553 --> 00:03:04,620 The final approach we're going to talk about is CSI, 86 86 00:03:04,620 --> 00:03:07,200 or the continual service improvement model. 87 87 00:03:07,200 --> 00:03:08,843 Now, the continual service improvement model 88 88 00:03:08,843 --> 00:03:10,920 is a process that helps organizations 89 89 00:03:10,920 --> 00:03:12,780 identify and implement changes 90 90 00:03:12,780 --> 00:03:14,049 to improve their services. 91 91 00:03:14,049 --> 00:03:16,233 In the context of security operations, 92 92 00:03:16,233 --> 00:03:18,180 this can involve ongoing monitoring 93 93 00:03:18,180 --> 00:03:19,500 of your security metrics, 94 94 00:03:19,500 --> 00:03:21,300 identifying areas for improvement 95 95 00:03:21,300 --> 00:03:22,380 and implementing changes 96 96 00:03:22,380 --> 00:03:24,480 to improve the efficiency and effectiveness 97 97 00:03:24,480 --> 00:03:26,640 of your security operations center. 98 98 00:03:26,640 --> 00:03:28,470 Now, in order to get the maximum benefit 99 99 00:03:28,470 --> 00:03:30,120 from standardized processes, 100 100 00:03:30,120 --> 00:03:32,370 standardization and process improvement 101 101 00:03:32,370 --> 00:03:33,390 has to be integrated 102 102 00:03:33,390 --> 00:03:35,872 into the organization's overall security strategy 103 103 00:03:35,872 --> 00:03:37,530 and your security teams 104 104 00:03:37,530 --> 00:03:40,500 need to continuously evaluate and improve their processes 105 105 00:03:40,500 --> 00:03:42,330 to ensure that they're meeting the evolving needs 106 106 00:03:42,330 --> 00:03:43,770 of your organization. 107 107 00:03:43,770 --> 00:03:46,260 Remember, standardized processes are critical 108 108 00:03:46,260 --> 00:03:48,630 to maximizing the efficiency and effectiveness 109 109 00:03:48,630 --> 00:03:51,180 of your organization's security operation center. 110 110 00:03:51,180 --> 00:03:54,180 So your organization needs to take the time upfront, 111 111 00:03:54,180 --> 00:03:56,276 that's necessary to create some standard processes 112 112 00:03:56,276 --> 00:03:57,900 and then continually improve them 113 113 00:03:57,900 --> 00:04:00,483 in an iterative and continuous manner, over time.