Security Operating Center (SOC) staff members are often consumed with tedious manual tasks that lead to burnout and can cost organizations millions of dollars in losses due to human error. Thomas Kinsella, Co-Founder & Chief Operating Officer at Tines discusses at length the challenges faced by SOC team members and makes actionable recommendations on how to decrease burnouts, increase retention, and create a better work environment for the security analysts.

To access and download the entire podcast summary with discussion highlights --

https://www.dchatte.com/episode-28-how-to-tackle-burnout-in-cybersecurity/

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Welcome to the Cybersecurity Readiness Podcast

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

A Holistic and High-Performance

Approach. He has been studying cybersecurity for over a decade,

authored and edited scholarly papers, delivered talks,

conducted webinars, consulted with companies, and served on a

cybersecurity SWAT team with Chief Information Security

officers. Dr. Chatterjee is an Associate Professor of

Management Information Systems at the Terry College of

Business, the University of Georgia, and Visiting Professor

at Duke University's Pratt School of Engineering.

Hello, everyone, I'm delighted to

welcome you to this episode of the Cybersecurity Readiness

Podcast Series. Our discussion today will revolve around

tackling burnout in cybersecurity, especially among

Security Operations Center (SOC) staff members. Thomas Kinsella,

Co-founder and Chief Operating Officer at Tines will share

thoughts and perspectives based on his experience, and also from

the findings of a very interesting research study

titled, Voice of the SOC Analyst. Welcome, Thomas.

Thank you very much. It's great to be on.

So, before we get into the Voice of the SOC

Analyst report details, Thomas, I'd like to give you this

opportunity to provide some highlights of your professional

journey.

Sure. So I think I'm a security engineer

through and through, I spent a little time working in

professional services. But then I joined eBay, PayPal, and was

on the technical investigations team there. So investigating

large scale criminal organizations, taking over huge

amount of accounts or committing large scale fraud on the site,

as well as investigating large scale intrusions for attribution

and prosecution. From there, I had the opportunity to join

DocuSign when it was relatively young, so myself and I own my

partner in Tines, our CEO, we joined the security operations

team when it was just the two of us. And we grew that team to by

30 people, while we went from like a Series C Company to

public and we were responsible for everything from incident

response, threat intelligence, eDiscovery, security

infrastructure, fraud, most things in security that weren't

compliance were reporting up to us. And it was really there that

we just felt like the same challenges that I think a lot of

security teams feel. So just overwhelmed. felt that the job

was really hard, and that there had to be a better way. I guess

that's where Tines came in. I'm sure we'll talk about Tines a

little bit later. I don't want to shell too much too much on

the show. I know it's not it's frowned upon a little bit. But

we started Tines, basically, because we believe there could

be a better automation platform. So it's now for a little over

four years old, we've got 120 people or so lots of really

happy customers. And yeah, it's just a super lightweight

automation platform and I run the customer success team. So

pre and post sales, engineering, we basically yeah, we're we have

a lot of customers that are automating loads of repetitive

manual security workflows.

Thank you Thomas. That really helps. So

you are the subject matter expert when it comes to SOC

operations. That's wonderful.

I won't say the, but I've certainly got a

little bit of experience, experience in that area, and

also like my day and my team's day, is talking to the best

security operations teams out there. I'm learning what they're

doing, learning how they're approaching the challenge. So

we've got a lot of perspectives, both from this report, but also

from a lot of a lot of customers and prospects and peers, I

suppose.

Sounds good. Yeah, we're all learning.

There is no such thing as definite expertise. It's

always evolving, same security. Yep,

I totally agree. So to set the context for

our discussion today, I'd like to share a couple of excerpts

from the study that we'll be talking about; one of which

says, in my 15 years of being a security practitioner, working

on incident response, and leading security teams, I

witnessed over and over again, that in the SOC, by the way, SOC

stands for security operations center, there's too much work

and not enough staff. More specifically, I saw overload

analysts so consumed with tedious, repetitive tasks that

it led not only to burn out, but to human error that could cost a

company millions. And this is really concerning, because you

can never overemphasize the importance of the work the SOC

team does. So to have the best and the brightest, fully

engaged, fully energized, is so critical. So it's not surprising

that the study would be conducted. But I'd like to,

again, ask you to share with the listeners what led to the study.

What's the purpose of the study? Yeah. So

I think we were working in security operations

teams, we were monitoring SOX, we talked to a lot of peers on

how they were doing. And we Yeah, that's what led us to

start Tines, Tines is four years old. And I think we were out of

the game a little bit. We were doing a lot of we were having a

lot of conversations with people saying, like, Hey, here's the

reason we started the company. But we want to know, was that

still the case? We wanted to know, like, had the life of a

security analyst improved? Were there better tools? Were there

better processes? Or was it still the case that they were

being overwhelmed with alerts, and that they were dealing with

too many repetitive manual tasks? And we didn't really have

the answer. And rather than go out and just claim it, we said,

actually, this would be really interesting. And also, we wanted

to find out Yeah, a little bit more like, hey, what how do

these people that are on the frontline actually feel? It's

not good enough to say like, Hey, the managers think that

they're overwhelmed. It's like, what do they feel? And how do

they do they enjoy the work? are they passionate about it? What

are their biggest frustrations? What are the things that they

loved the most? What would they do if they had more time? So we

went away, and we came up with a list of questions that we

thought would be super interesting to find out. And

yeah, we conducted the study, but really was the aim of it was

to see whether or not our like, our initial thoughts still held

true, and gathered some really interesting information that

could be useful for not just SOC teams, but also like CISOs, who

are making decisions and information security

professionals and managers around around the world.

Sounds great. Sounds great. So so as

far as the methodology and participant demographics go, let

me share with the listeners a couple of highlights here. 468,

full-time security analysts were surveyed, they worked at

companies with 500 or more employees. The survey was

conducted online via poll fish using organic sampling. And 45%

of the surveyed security analysts work in the technology

sector. In addition, manufacturing, healthcare,

finance, education, utilities, insurance, services, state and

local government, retail and federal, were the other industry

sectors represented in the sample. So the survey really is

representatives of what's going on in a wide range of

industries. So that's really a major strength of this

particular survey. Yeah. Before you get to the findings, Thomas,

would you like to add anything to this, methodology?

Yeah, maybe just maybe one or two things.

The first is that we only survey people in the United States. So

we didn't survey for example, people who were working on a lot

of organizations have like eight sourced security operation

centers in India, for example, or in the Philippines, we didn't

study those, we felt they're a little bit different. And a

little bit out of the scope of what we were what we were

looking at. And the second thing was just in terms of the number

of employees, we tried to split it up roughly as best as we saw

the the market. So I think it's 50% or so are in that mid market

500 to 1000 person company, I think 30% or so are in the one

to 5000, and then 20% are above 5000, a lot more enterprise

category. So it's pretty broad, but it is a little bit skewed

path, skewed may not be the word, but there's certainly a

lot of ways in not, you know, 500 to 1000 person or some

company just for reference. Now we have the data, we've broken

it down, we've pivoted on on a bunch of different ways.

Honestly, it's very consistent throughout, as you'd expect. But

even still, it's just worth noting,

Thanks for sharing that. So So would you

say that it's mostly mid-market organizations that you all were

able to tap into?

Well, 20% or enterprise? obovata? Oh, 5000.

So there's certainly there's certainly a lot there. Um, as I

said, the the findings were very consistent, but yet that I think

that it's fair to say I'd like between, like if 80% are between

500 and 5000, that makes it, makes it mostly that mid-market

section.

Okay, fantastic. So now getting to the

key findings. Let's go through each one of these. The first one

says 71% of the analysts experience some level of

burnout. This could be due to the fact that 69% are

understaffed, and 60% have seen increased workloads over the

past year. Was this surprising to y'all?

Not particularly surprising to me,

but I think there were some adjacent findings to it that

were a little bit surprising. So I think the SOC staff felt

burned out is like if you go to a conference or you talk to

people, like online or if you interview people for jobs,

they'll say, Yeah, I'm just overwhelmed or not, not

everybody, but most so that that finding wasn't that wasn't too

surprising. But there were definitely like the fact that

69% say they're understaffed. Again, that's not too

surprising, 60% seeing increased workloads over the last year was

a little surprising, you would think that things were getting a

little bit better. But there were some I suppose, adjacent

findings, just arraign that in relation to them, burning out.

So there were some interesting things like 69% of them said

they were satisfied with their job. And 68% said they were very

engaged. And another same 69% said, they felt respected by

their peers outside the SOC. What you normally get with, not

always what what burnout, it's kind of a combination of a

combination of factors, there's, you can deal, you can deal with

things and you just want to you want to quit, you feel like it's

not worth it. But in this, it kind of suggests that there's

actually a certain element of, they really do want to do a good

job, that it's not just like they want to, they want to quit,

they want to give up that forget about it. It's that they

actually they even to some extent, really enjoy doing their

job, they feel respected, they get a lot of worth out of doing

it. So that was really the fact that that those two kind of

clash is really it's just a really interesting, it's really

interesting tension between the between the points, but no,

initially definitely, like that confirmed our suspicions the

fact that 70% or so felt burnt out is not it was not really it

was not very surprising.

Yeh, just to build on what you said about

that interesting tension that security analysts are by nature

excited, energized, passionate, yet, they are feeling burnt out.

And again, referring to another finding which states that 64%

say they are likely to switch jobs in the next year. So the

turnover is, is going to be very high. So what do you recommend

organizations do to deal with this challenge?

Well, I think that just to highlight, to

thread on something there, 64% say they intend to leave their

jobs. That's not to say that they will actually leave their

jobs, I think they definitely intend to. But yeah, even with

the best intentions, you may a) may not find a job or b) maybe

things will get better or c) it's hard to find the time and

d) this was also taken earlier this year, and the economy's

shifted a little bit, so I don't know how risk-averse or

risk-prone people will be. But certainly a lot of people said

they intend to do that. In terms of I suppose looking at

recommendations, I think I think you have to drill into the data

a little bit more to kind of understand some of the pain

points that people are people are seeing. So when we asked,

like, I can't say, Hey, here's a recommendation without trying to

try to say like, actually, what are what are the challenges? And

when we asked people what some of their most frustrating

aspects of work, this was the like, this is a multiple choice

question. But over 50% of people said spending time on manual

work was one of the most frustrating aspects of their

work. The second highest a 37% was the high false positive

rates. And the third highest was 35%, too many different consoles

and tools to investigate incidents. So it really is that

it seems to me they enjoy the work, they feel respected, but

that you're just spending your time shifting from screen to

screen investigating alerts that are not high enough fidelity.

And as a result, you're you're switching context, you're you

don't like that it's you're not feeling productive. So even

though like people don't mind, my experience, people don't mind

working hard if they feel like they're adding a ton of value

and feeling like they're productive. In this case, people

can see the importance of the work. But I think it's just like

automatable, manual, boring, trivial. And I can see why that

really leads to burnout and leads to leads to you wanting to

move to an organization that's better that has better tools or

that has better processes. So I think there's a lot of things

that we can do. But those are certainly the highlights that I

would say that we can if we want to if if we want to fix things,

there are some of the challenges that we can we can address.

Thanks for sharing. So as you were

describing the challenges one thought comes to mind is why

hasn't this automation aspect been addressed yet? Because as

we know that from time to time, intelligence is either not

detected, or intelligence is not acted upon. So lots of misses

happen. And it takes one mistake that could lead to a huge

breach. So the the work of the security operations center, I

would think is mission critical. So, why isn't priority given to

review the workflow, make assessments and bring about

process improvements, which includes automation. I'm just

trying to understand, what's the rationale behind not doing

something about it yet.

I think some I think a lot of first of all, a

lot of organizations have a lot of organizations have embraced

automation clearly, like, in my opinion, not enough. But also

sometimes it's really hard to find the like, if you're

overwhelmed with alerts, it can kind of be hard to find the time

to put your head above the parapet to actually start taking

out taking action. So if you don't have time to, to audit,

like if you're the analogy that we we normally normally give,

and I'm not I'm not a huge sports person, I'm also from

Ireland. So I'll probably butcher this analogy. But if you

imagine in American football, if your team are on the field

playing defense all the time, the answer is do you need a

better defense or actually probably need a better offense.

And I think that the challenge is that they probably need to

hire some people and train them up to be, hey, here's how we

automate or use a super lightweight tool like Tines and

allow people the time. But if you're spending all your time

responding to alerts, it's really hard to it's really hard

to find that time. The second part and this is kind of ironic,

but the better you get at detecting, the more you have to

respond to. So if you purchase a new tool, all of a sudden, it's

like, brilliant, we've got better, I've got better

visibility into our environment, to a certain extent, you can

tune your alerts better, absolutely. But if you purchase

a new EDR tool, it's not as a pure alerts, you're gonna go

down. Sorry, EDR is Enterprise Detection Response tool. So

sorry, Endpoint Detection Response tool. So a tool like

CrowdStrike, or Carbon Black or SentinelOne or something like

that. If you purchase a tool like that, you all of a sudden,

just by definition, have to respond to alerts, and then you

have to tune in them. So it takes a long time to, I suppose

get to a stage that you're ready to, you're not that you're ready

to automate, you can always be ready to automate. But it can

can actually take a lot of work. The analogy that I sometimes

give for that is that purchasing a tool is often equivalent to

purchasing weights, or purchasing an exercise bike,

they're actually they're good, but they actually just look good

in the corner unless you're prepared to use them. So you

have to put in the work to use them to tune them to get the

value out of them. And I think that's the case with with

automation and with a lot of other products as well, that

people find it too difficult. And that's kind of why we

created Tines, again, don't want to don't wanna shill. But yeah,

we tried to make it super lightweight automation platform

so that those analysts that are on the front line that don't

have that engineering experience, or that don't know

how to code that they can automate the workflow. So they

know code, they know how to investigate a suspicious IP

address, they know how to investigate a suspicious file.

That's what they're doing all day, every day. So we give them

the tools to investigate that and automate that themselves. So

that they don't have to call in and other teams do.

Yeah, absolutely. So we're basically

talking about a thoughtful automation and not mindless

automation, which is, which happens a lot, I can refer to

say the whole ERP system phenomenon, enterprise resource

planning systems where companies invest in an ERP, but they're

not ready to fully leverage all the functionalities for a

variety of reasons -- procedural, people-related,

structural, cultural. So whenever you're trying to

implement a new technology, a new solution, the organization

should be prepared, there should be a certain level of readiness.

And I'm sure that applies to this particular automation that

that you're talking about.

You it's really hard to automate a process if

you don't have a process is the is the answer.

And often times, you want to better the

process before you apply technology to it right. You

don't want to automate an inefficient process.

like that manual work, day in day out.

They do know how to like process a phishing email, they know,

okay, we analyze the headers in this particular tool, we check

out the URLs in this particular tool, we upload the files to

this sandbox, we add all the results to our case management

system. And then an hour later, we reply to the end user saying

thank you for reporting this mail. It was malicious. That's a

process. And even though in your head, that's only three or four

steps, it's probably 50 or 60 steps, because you take

different steps, if they're the CEO of the organization; you

take different steps if it looks like it's benign, immediately,

you take maybe it's failed decam or something and you take

another step. So there's there's a lot of different steps, but

the analyst usually knows that. So it's about enabling, enabling

that person who knows that process to automate that

automate that task. Okay.

And so when organizations, let's say they

make the decision of investing in an automation platform, yeah.

What else goes with it? Yeah, make that a truly successful

experience.

I think there's, there's, there's a lot

of different things. Obviously, you have to assign people to do

some work on it. But there's also important things that you

should be thinking about when you're enabling your team just

in general, right? So one thing that you should always be

considering is, this isn't something you'll do with your

automation platform. But it's tracking the tracking the alerts

by the user, just like by the, you should be tracking the MTTR

mean time to respond, you should be tracking mean time to detect,

but also like, who's responding and who's building these. So

that who's building is important, because what you're

identifying is, hey, do we have a single point of failure here

who's absolutely critical, maybe she's a rockstar, and she's

built 10 workflows, you probably a) need to keep that person b)

you need to train somebody else up who knows your workflows,

because she leaves she's kind of take the team with her. And the

second part is the tracking who's responding to those

alerts, even if they're enriched, and there's automated,

there's still some response. Because it can all you can still

have people that are left behind that are doing that manual,

boring work. And what you want to do is you want to make that

triage fun again, you want to get people automating the

boring, but also keeping the really exciting parts of

security. Security is an incredibly exciting area. It's

growing really fast. There's a never ending number of threats.

That's why a lot of us got into it, that you have an opportunity

to grow your career and learn very, very fast. But you don't.

You're Yeah, analyzing adware all the time. And you don't come

across a new breed of malware. Or you see people on Twitter

talking about, oh, look, there's this macro enabled malware

that's hitting em, I'm not sure was it MTD dot exe or whatever,

then you add the new the new ballgame in Microsoft was or

bypass and Microsoft in Windows was, if you can't investigate

that, it's pretty frustrating. So you want to make it so that

you can they these people can have some fun. The next thing

that you want to you want to be investigating just in general is

how much time people are taking off. So are they actually

overwhelmed? Are they spending enough time here? Are they

spending enough time like taking holidays? Or are they working

all the time? Are they working overtime? How many times have

they been paged? How many times? How much time are they spending

on call, because that's another measure of how quickly people

will leave the organization or how happy they are in the

organization. If they're on call all the time. They're getting

paged all the time, you're not doing it, you're not doing it

right. And in many ways you have to you have to shift left and

reduce the risks in your in your organization. There's a whole

lot of other things, but there's some of the things that I can

I'd recommend.

Sure. Now, what do you think about job

rotation and job enrichment? In the context of, is that done

well? is that done well enough to make make it a little more

interesting for the staff?

definitely can be definitely can be done. And

especially a lot of people who are younger in their careers

actually valued that to a certain extent over they know,

and rightly so they view their careers as like, I'll be working

here for Barbie working for 40 years, I want to try out a few

different things, rather than choosing my career, I'd like

sticking with it for the rest of the rest of my life. So a lot of

people will really value that. So if you get the opportunity,

or if you offer people the opportunity to grow, that could

be like go deeper into malware analysis. But if you give them

the opportunity to work in compliance, or work on the Red

team, or do a shift in IT, and vice versa, you're also you're

you're you're retaining your staff, and you're keeping them

at you're keeping them happier. The next thing is that that's

actually really important for diversity. So a lot of people, a

lot of organizations, they they'll the people that they

hire are that are experienced, they'll be coming from like,

they'll be privileged white men basically. And if you enable a

job rotation, you're able to enable internships, you're able

to get people with a different background in who you may not

have traditionally thought had the skill set to perform SOC

duties or to work on a security operations team. If you allow,

if you like, job rotation, not only are you getting people from

different backgrounds, you're getting people from different

skill sets, and you're expanding the pool of candidates that you

want. That's so important. Like right now, this isn't anything

to do with the report, but it's not a it's not something we

found in the report. But there's something like 1.8 people for

every single job that's needed in security in the United

States, there's 600,000 vacancies, we're not going to

fill that by just by by continuing with the same, ah

well we'll hire out of the cybersecurity programs in these

20 universities. The way we're going to fill it is by having a

lot of people from a whole diverse, diverse range of

backgrounds, get interested in cybersecurity and be exposed to

cybersecurity. So the best teams are doing that and they'll

they'll find like a lot of diamonds in there they'll find a

lot of real gems that like are super super smart in information

security and can add a whole load, and aren't more

importantly just coming from that same mode of thinking, they

will question things, they will question processes. Yeah, that's

definitely effective.

Fantastic. So there is another thought

here. So, talking about job rotation job enrichment. Yeah, I

think this creates a great opportunity for an organization

to get the security people outside their comfort zone, and

expose them to other company operations. And also get people

from the other business operations and bring them into

the SOC center. So they have a sense of what the analysts do,

and what goes on, because by engaging in this kind of an

exercise, which I would like to call it a little out-of-the box

exercise, and which might seem going against the grain of

focusing on expertise, but what it does, it sensitizes, the

entire organization, to the importance of the work the

analysts do, the security analysts do, and also to the

challenges. So this way, the knowledge is spreading, it is

getting to the ears of the top management and other decision

makers. And at the same time, it's also enhancing the level of

awareness and skill sets of the folks who didn't intend on

having a career in security analytics. So by taking this

approach, you're broadening the pool, you might be able to

attract talent from within the organization, like you said,

there is a scarcity of talent in general. So maybe you can tap

into some some talent within the organization. And that kind of

talent is useful because they understand the business. And

they also understand the security. The second point I

wanted to make it goes back to my experience in corporate. When

I started my career, and I was in audit and I was in systems

audit, I often wondered that I do this work, who really cares?

Who does it impact, because you are again, focused in a small

area, and you are not seeing the big picture. And that creates

disillusionment. And I wouldn't be surprised if that happens in

this particular context, as well. So to be able to offer the

security operating center team, the staff members, that be

exposed them to show them that how their work is valued, how it

relates to the top line and the bottom line. That reinforcement

that awareness, again, is very helpful. It makes you feel that

yes, I am in security which is seems like a staff function. But

what I do is equally valuable and important, as the line

folks. Does that gel with you?

Yeah, 100%, there's so much that you've had

that you've shared there. That's yeah, it's good wisdom. There's

a great book of 20 things. And there's a great book called

Delivering Happiness by Tony, I'm not going to pronounce his

surname correctly, Tony, I think it's Hsieh but I'm not sure. And

it's about his journey to start the shoe company Zappos. It's

absolutely fascinating. One of my favorite books, I'd recommend

that every every listener read it or listen to us. But he talks

about, like company culture, there are some really out their

ideas in terms of matrix org structures for the organization.

But one of the things that every single person who joins the

organization must do is spend the first two weeks or the first

two weeks in training. But after that two weeks, on the phone

with customers, so their biggest problem is Delivering Happiness.

They're Delivering Happiness to every single one of their

employees, sorry, to one of their employees to one of their

customers. So as a result, everybody from the new VP, the

new CEO, all the way down to obviously somebody working in

customer service, they have to begin their journey on the

customer floor talking to customers and it's so so

impactful. In that it means that everybody understands the

importance of that job. And also the perspective of actually

we're delivering delivering to like the top line as well as the

as well as the bottom line. It's already it's really impressive.

The second part in terms of the security team feeling, I suppose

disillusion because they don't feel that love. And they don't

feel that like if you're separate from the organization,

it's so rare to see. And this is where like automation can come

in. But it's also where like delivering interesting threat

research or spending time outside of that analyst job can

do it. It's so rare to see in an organization or security

organization, like do anything innovative in a company that

often they are just seen as wow they are protecting us from this

threat. But in reality, first of all, many companies and in many

institutions, the security and the organization's reputation is

critical, right. If you get breached, it's a devastating

impact to your your team to your get to your staff, to your

customers to your get to do to every single person involved and

potentially add it to your stock price. or to the reputation of

your university or your organization. But that doesn't

mean that like security analyst feel that often they feel that

as a pressure. On the other hand, what we seen when people

start implementing Tines or other automation platforms, it's

incredible to see a CISO be able to brag about like, Hey, here's

how much work we've automated. We've automated 72 hours of

manual work that we would normally be spending every

single week, we've automated that. But what's even cooler is

when the CISO talks about, "here, we're able to offboard

employees in five minutes using this using this platform." And

what you'll see is IT be like, "hold on a second, it takes us

like eight hours to onboard these employees on the Sunday

before they join and set them up with all these tools. How did

you do that? And the CISO is like I am using this tool. Or

you see the like the the security team in the middle of

an incident start pain indicators enriched into a Slack

channel that's been set up and everything has been archived for

compliance purposes. There's an audit trail of every single

thing that's happening. And meanwhile, the site reliability

engineering team or the tech ops team are in the same chat, or on

the same zoom or incident meeting. They're like, hold on a

second, how are you doing this? How are you monitoring these

things? This is crazy. This takes us, you know, hours to do,

how are you moving so fast that like, Oh, we're doing this,

we're using this tool. And it's so exciting to see that because

all of a sudden the CISO is adding value, but also getting

credit in the organization and being like, wow, you've you've

done an incredible job here. This is this is really exciting.

And that is yeah, like the CISOs job is normally like delivering

bad news and fighting fires, it's very rarely Yep, check it

out, check out the awesome things that I'm doing. So that's

really exciting. And that swagger that they can have

afterwards. It goes so far to building those relationships

with the IT team or with the tech ops team, with the

engineering team. They're like why these these people know what

they're talking about. And you start being able to move from

that organization or that team that's just bring us problems to

these these folks know what they are doing. And like, yeah,

she's, she's an amazing leader. So that's it's really exciting

to see that sort of thing happen.

Very true. In an earlier podcast, I was

talking to the CEO of a billion dollar company, insurance

company. And I made a statement I said, the more I think about

it, the job of a CISO is kind of a thankless job. Yeah. Because

you don't get recognized in general if things are going

well. But if something goes wrong, and you're breached,

obviously, that person is under gets the all the spotlight, the

focus and probably can lose their job. In reacting to that,

this gentleman very articulate, said, Dr. Chatterjee, I, I beg

to disagree. I think it's a very important job. It's not a

thankless job. And I said, You know what, I couldn't agree with

you more, I definitely the C suite, the CEO, the CEO of the

company, senior leadership should remember that should

recognize that and accordingly, empower the function. So that is

one aspect, because after all, that empowerment percolates

right to teams such as the SOC, because how the CISO is viewed

and valued in the organization will have an impact on how the

SOC team feels about their work and the importance of their

work. So it's an interesting dynamic, but that's something

that organizations to be must be sensitive to. And it again, goes

speaks to the point that automation is not the entire

solution. No, no, definitely not. But automation needs to be

supported by appropriate structure, right kind of

processes, right kinds of people. Sorry, you wanted to say

something?

Yeah, no, just just definitely like it's not

it's definitely not it's certainly not the only solution.

There's a ton of a ton of things you can be doing. But also that

it's even though something can be an extremely important job,

that doesn't refute that it can be thankless, like it doesn't

like it's still really, really hard. And it's not, it's not

it's not not too surprising. The average tenure of a CISO is

something like 18 months. That's like, I don't think that's their

choice. Most of the time. I think it's it's really hard to

come in and be effective. And oftentimes there's yeah,

resistance to to how effective they can be. Yep,

True! So, reverting back to the actionable

takeaways from the report, I like to share with the

listeners, four of them. And then I have a couple of

questions. The first one says -- improving time spent on

reporting, the second one is -- making triage enjoyable. The

third one -- increasing retention by measuring and

minimizing burnout, and the fourth --it's time for no code

automation. My first question here is, when it is stated

improving time spent on reporting, what do you mean?

Because I would think that you want to reduce the time that is

spent the manual hours that is spent in delivering different

types of types of reports. Can you clarify?

Yeah, I think there's, I think there's a few

things that that that came from that came from this. So it's

probably a little bit it's definitely a little bit

confusing. The first is, it's where they spend a huge amount

of their time on like time consuming tasks. So I think it

was literally the place, they said they spent the most tasks

was like capturing notes, capturing metrics, filling out

tickets, all that sort of stuff. So I think improve is make that

like faster and make sure that you're like you're actually

adding value as opposed to just copying and pasting. So I think

that's, that's one thing that you can definitely do. So

basically, don't be filling out the same IP address 10 times get

as much information into a ticket beforehand. And then like

track, yes track what incidents are coming up all the time, and

add value to that reporting. So adding value to that reporting

could be actually this alert is super noisy, and is a false

positive 95% of the time, so it needs to be tuned. Or as I said,

this person is answering 95% of the tickets, or maybe it's not

like actually, this alert is super high fidelity, maybe we

should be looking into building out building a few, a few more

of these. So I think that's some of the things that we talked

that we were recommending, were saying improving time spent on

reporting is like actually just making it more valuable, rather

than just Yeah, filling out an employee's job title and a

ticket, that that is not something that you that you

need. It's something that's actually really important, but

it's not something that you should be doing manually.

Okay. That's good to know. And then

moving on to the second recommendation, which is: making

triage, enjoyable, how do you do that? And if you could clarify

for the audience, what do you mean by triage here?

Yeah, so triage is that process of investigating

and alert when it comes in? So if you think of a suspicious

login alert, this is probably the most common it's the process

of taking that IP address and saying, Hey, have we where is

this We got an alert that Steve logged in from Egypt. Okay,

like, let's take that IP address. Is it on any known

threat intel lists has it been seen as bad before? Is Steve

actually in Egypt? Is it possible that Steve's on

holidays? Where's Steve normally based? Does Steve use a MacBook

because it looks like this was a login login from a Windows. That

process of triaging an alert is just basically investigating the

steps involved, it could be looking in your threat intel

tool, or it could be looking in your in your Sim for additional

logs, or it could be investigating on your in your

EDR tool or in your Cloud console in AWS, it doesn't

really it doesn't really matter. The problem with this one, when

we say make triage more enjoyable, is that bad triage is

that repetitive analysis for duplicate alerts following the

screen, same script over and over again. It's noise. It's

easy. It's mundane, it's boring. But even worse than that, it's

error prone. If you're doing this day in day out for your

organization, you're not adding any value. But you're also going

to be like, Ah, I think this I think I've seen that IP address

before or I think yeah, I think I saw that Dave was in Egypt.

And that's not that's not something you want to do. So

making it more fun, is that process of like being a

detective, that's what people really enjoy about security is

that like, ha, I'm detecting something good. Like, this is

really interesting. And I remember, so when I worked in,

in one of my organizations, we were seeing a load of malspam

campaigns. So that's malware campaigns being delivered

through phishing. And if you're familiar with those, you'll see

the standard names like Emotet, or TRickBot or Hancitor, there's

loads of them. And they're really like, they're insidious,

you'll get hit with them, like loads of times every single day.

But we have a lot of fun in my organization, when we initiated

a policy -- the first person to track the fruit or that the

first Hancitor email of the day, the first person that can post

that in Slack, like won a prize. Basically, there was just a

competition to investigate that. And what that meant was that

every single mail you were immediately on it. Like, okay,

what is this? But the next part about it was that you actually

started noticing the patterns here, like actually, I don't

think Hancitor ever used a Ring Central team before. Probably

not Hancitor. Or it's like, oh, yeah, Hancitor, they recently

shifted up their techniques to use this dot doc file, like this

probably is them. So you start getting people to go deeper, but

also making people a little bit more excited about like the work

that they're doing and not just adding, not just adding that

boring stuff day in, day out. It's hard to do, but honestly

you can do it and if you like if you If you make a, generate some

challenges, and you, you get people thinking creatively, and

get people digging deeper, they remember the parts about

security, they really love to tell I'm getting excited about

thinking about it. Now that that was fun. But honestly before

that, like when we just saw 20 mails come in, that wasn't

funny. This is hard you know. So it's making making that triage

process running. And, and there's a lot of things that you

can do that you can do for that. So you need to design your team

to around I suppose, minimizing those noisy, easy, mundane

alerts and maximizing those like being indicative of those

creative alerts and creative processes that are hard, but

also really worthwhile? You know?

Absolutely. So one thing that is coming

through very clearly, from your articulation is one of the

challenges and success factor is to be able to tease out and

emphasize the creative aspects of the job, while automating the

non- creative aspects.

Exactly that that like that if that. And

honestly, the non creative aspect is, is all automatable.

That's like, that's why that's why people find it boring. Like,

if you're looking up an IP address, and five different

tools are looking at the hash in 10 different tools or asking a

user Hey, do you are you on holidays? Or asking a manager,

"did you assign these permissions to this person,"

that's the stuff that you're gonna burn out on. But all of

that is actually very easy to do in automation. They're all just

simple API calls, or they're simple tasks, like sending an

email or sending user message in teams or slack.

Okay, fantastic. So moving on to the

third recommended takeaway or actionable item, which is --

increasing retention by measuring and minimizing

burnout. Can you expand on that?

Yeah, so I think with this that, there's a

lot of like, burnout is not lack of support, it's taking on more

that you can handle. It's poor self care. And I think what when

we measure the achievements of a SOC, we do measure, like the

mean time to investigate, the mean time to detect, but what

we're not tracking is, I suppose, how our employees are

doing as part of that, or if we are sometimes just the number of

tickets that they've answered, which doesn't tell you hey, how

hard those tickets were or even, like, yeah, if they're working

overtime, or if they're, if there's any indicators of

burnout. There's some people that have done a lot of great

work on this MongoDB have great articles on this on their on

their website, if you want to check it out. But things like

measuring who is taking their holidays. So if you're, if

you've got somebody who's worked 50 of the last 52 weeks, and has

also worked several weekends been paged? That person's

definitely burning out. Like there's they haven't had the

time to to reflect and get time aid from the organization. Yeah,

so who's working weekends who's working overtime? And employee

satisfaction reports, but also considering those like recurring

employees satisfaction reports, but also like management

one-on-one. So spending individual time as a manager

with each of your employees? And asking them genuinely, Hey, how

are you doing? What do you want to work on? What are your goals

for the next three months, and then reviewing those goals after

those three months standard management stuff, but again, it

doesn't happen when you're slammed with alerts. But those

are I think, those are some of the things that we that we

recommend that it's just not good enough to, just not good

enough to measure this the standard things in a SOC, in

order to keep your team and this time you, you have to start

measuring, measuring how they're performing, and not just how

many tickets they've opened. But more importantly, like, hey, you

know, how they're actually performing and how their mental

health is performing. It's a really tough job. So we need to

track it. The last part about that, sorry, I should have said

this at the start. It's important to be really open

about your mental health and talk about normalizing the

conversation and saying, this is a tough job. It's okay, if

you're struggling, it's okay if you find this overwhelming. And

offering in place, you can talk to me, you can talk to your

manager, you can talk to your peers, or you can talk using the

employee assistance program if you have it in place. But in

managers, normalizing that conversation saying I've been

burnt out at work, or I've experienced these challenges

with my mental health is really, really important to share.

Otherwise, you're, you're you're kind of saying like, ya know,

like, I'm sure you're burnt out, but I've never shown any

experience of like, of noting that's only weak people are, you

can't do that. It's like incredibly strong and incredibly

just intelligent people. Everybody gets experiences. It's

not something that you're doing wrong. It's the same as breaking

a leg playing sports or something like that. It can

happen to everybody.

I'm so glad you said what you said because

it's so important to have that candid conversation, or to

create an environment of honesty and candor where somebody can

just go to their manager or to their peers and say, Look, I'm

experiencing this I could do with some help and offer that

help without treating it as some kind of inability, it is not an

inability, like you said it can happen to everyone. And this

reminds me of something from another episode where this CISO

takes this approach, where when a particular user fell victim to

a phishing attack, and confessed and said, Look, yes, I was

trained, but I messed up. I'm sorry about it. Recognizing the

honesty of it, and using that user, as an example, of somebody

quickly reporting the breach, alerting everyone and not trying

to hide and trying to fend off investigations, and rewarding

that kind of honest behavior, and then supporting it with any

other kinds of educational programs. That is so very

critical. And I'm glad that you all are talking about it in as

one of the takeaways. So we are running out of time.

Can I add really I know we're running out

of time but really quickly to that. I had a fantastic

experience, where we had a we had an incident in again, in my

career where we had a an executive assistant, so a

C-level staff member's executive assistant, report a phishing

email, didn't click on it, just reported. We said, Oh, wow,

okay, this looks targeted, like the fact that a C-level staff

member is receiving a phishing email or an executive assistant

receiving phishing email, this is bad, we look to see had

anybody clicked on the link. And we detected three people had

clicked on the link. And when we look to see who received the

email, five people, in addition to the executive assistant had

received it; all executive assistants. So at this point, we

had like, not whatever, six recipients, three people clicked

on that link, we contacted those three people, two of them had

entered their credentials, we locked their accounts

immediately, like investigated, we saw a failed login to their

failed logins to their accounts by 30 minutes later. And the

only reason we detected it was as a result of that one

executive assistant reporting. It was incredible. We like we

gave her loads of loads of loads of props, as you'd expect, but

it really was an indication of I'd much rather you report

those, every even if you're unsure, report that phishing

email, because without her, we would have had a major major

incident on our hands. Because all of those have like, well,

they've got access to a lot of sensitive information anyway.

But they also have access to their C level staff members

mailboxes. So it was really, really important, but super

critical. So definitely, shame is the exact opposite of what we

should be doing in security, we should be like, it's so hard to

get right. We have to be encouraging people to report and

knowing that like, people are gonna make mistakes. That's why

we have defense in depth.

Absolutely. Thank you for sharing that. So

Yeah, so like, I think a lot of people have

thought of automation. So that's writing scripts. The challenge

with a lot of automation is that it's really hard to do. And as a

result, those people that know the processes just can't do it.

So what we built in Tines is we built a really lightweight,

no-code automation platform that allows anybody, so that's like

interns, or like, like low level, low level is not a good

word, like SOC analysts of like tier one, or engineers to

automate their own workflows. So that could be that manual task

of investigating an IP, it could be an engineer who knows how to

finally, let's talk about the fourth actionable takeaway, not

like build an incredibly complex process. Their tool is simple,

but not simplistic, it can go very deep. But the idea is that

those people who know the process will be able to use in

our case, a simple drag and drop builder to automate away those

tasks. So just to say, Okay, I want to investigate an IP

address in this tool, I'm going to drag on an action and I can

investigate that IP address, I want to send an email, or drag

on an action and send an email, I want to contact a user on

Slack, I will drag on an action, and contact a user on Slack. And

we make it simple enough that people with very, very little

experience are able to build and as a result, allow them to focus

on much more impactful risk reduction efforts. The no code

part is just that it's we make it super easy so that you really

don't need to be a developer. It's not to say that you don't

know how to you also have to know what an IP address is kind

of thing. But it means that it's just Yes, super, super flexible,

necessarily, in the order of importance is just the number

lightweight, easy to learn. And we've got yet some incredible

teams from the small startups through awesome security teams,

great, great consumer teams, some universities, yeah, like

four. And and that is -- it's time for no-code automation.

all the way up to Fortune 10s using the using the platform to

all in they're all in the exact same way. So that's what it is.

But the power of that is really so the reason we say that as a

takeaway is that if you allow those people that are super

familiar with the process, they're able to they say, I know

exactly what this is. But also it means that when there's a

tweak to the process, I actually normally if it's the CEO, we

What does that mean?

won't send the thanks reporting will be back to you in 24 hours,

email will probably say, yes, we'll be back to you

immediately, or we'll alert somebody and wake up somebody to

respond to that. And that part is the people that are familiar

with that process are able to automate that part of the

process as well. So that's that that's, that's the idea behind

it. And then ultimately, it's that if you do that, first of

all, they're fulfilling that creative part that you kind of

talked about earlier. And then they're, they're no longer

dealing with as many manual repetitive alerts, and they're

able to focus on much more impactful risk reduction efforts

that are actually going to add value to to the business. That's

Fantastic. Yeah. I mean, so if you can, the

the idea.

extent to which you can reduce the technical hurdle, it always

helps, it helps get more people involved and interested, and

engaged. Well, Thomas, this was a fascinating discussion. I wish

we could go on. But in the interest of time, we have to

conclude here once again, before we wrap things up, do you have

any final words for the listeners

just yet? Thank you so much. I've really enjoyed

being on if you do want to check out Tines, we've got a free

community edition. So anybody can use it. Tines.com just sign

up for I think you get three workflows completely for free.

And yeah, you can reach out and say hi, I'm on

twitter.com/thomas ksec, LinkedIn on just Thomas

Kinsella. And yeah, I'd love to say hi, especially anybody that

wants to talk about the future of security operations, or

mental health burn out, the future of the SOC. I'd love to

have those conversations. And yeh please do reach out.

Well, thank you, Thomas. It's been a real

pleasure. Thank you. A special thanks to Thomas Kinsella for

his time and insights. If you liked what you heard, please

leave the podcast a rating and share it with your network. Also

subscribe to the show so you don't miss any new episodes.

Thank you for listening, and I'll see you in the next

episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as-is basis with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.