Security Teams and Competencies

Lesson plan

Level

Beginner

Time

About 55 minutes; the steps below add up to 54

Learners map a hospital’s watchers, crash team and ward builders onto security work, and ask whether one person could do it all, before the teams are named. Predictions then precede a loop of the seven competencies, whether a SOC prevents breaches, why security is cheaper built in, what six roles and teams contribute to a cloud move and what an unpassed alert costs; checks follow a restore test, “responds”, containment and the ISSO. The habit to build: name who watches, who responds and who builds, and where the hand-overs are.

Objectives

• Name the seven security competencies and connect them as capability areas
• Describe what the SOC, the incident response team and DevSecOps each focus on
• Tell an individual role from a team
• Follow one change through every role and team
• Explain why hand-overs between teams matter

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Security Roles and Responsibilities lesson first.
• Three headings on the board, Watches, Responds, Builds, help sort the teams.
• The lesson takes about 54 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Name the seven security competencies and connect them as capability areas
   • Describe what the SOC, the incident response team and DevSecOps each focus on
   • Tell an individual role from a team
   • Follow one change through every role and team
   • Explain why hand-overs between teams matter

   Purpose: Learners map a hospital’s watchers, crash team and ward builders onto security work, and ask whether one person could do it all, before the teams are named. Predictions then precede a loop of the seven competencies, whether a SOC prevents breaches, why security is cheaper built in, what six roles and teams contribute to a cloud move and what an unpassed alert costs; checks follow a restore test, “responds”, containment and the ISSO. The habit to build: name who watches, who responds and who builds, and where the hand-overs are.

2. 1. Watch, respond, build Think 5 min

   Purpose: Map a hospital’s groups onto security teams.

   Ask

   • What would the security equivalents do?
   • Can one person do it all?

   Responses to expect

   • Watching and responding come easily; building in safety needs a prompt.
   • On screen in turns: the opening question, its answer; then the question on one expert in everything, and its answer.

   Discussion pause: Let learners name each equivalent before revealing.

   In the lesson window

   • Think it through: A hospital has people who watch patients’ monitors, a crash team that rushes in when something goes wrong, and builders who design new wards to be safe from the start. What might the security equivalents of those three groups do?
   • Think it through: Can one person be expert in every part of security work?

3. 2. What security professionals need to be able to do Predict 8 min

   Purpose: List the seven competencies and connect them as a loop.

   Ask

   • Can you arrange them as a loop?
   • Which competency is a restore test?

   Responses to expect

   • Learners often treat them as seven jobs.
   • Diagram: after the class has tried its own loop, step through the seven areas and compare the order.
   • On screen in turns: the opening; then the question on making a loop, and its answer; the seven areas as a loop, one at a time; control access; secure systems; monitor activity; respond to incidents; recover operations; improve people and processes; the seven areas in plain words, with examples held back; an everyday example of each; the check question on a restore test, and its answer; where each area is taught.

   Misconceptions to challenge

   • A learner may believe: “The competencies are seven separate jobs.” Respond: They connect, and most roles need several.

   In the lesson window

   • Think it through: Look at the seven competencies. Could you arrange them as a loop, in which each feeds the next? Try.
   • Check your understanding: Testing that last night’s backup can be restored belongs to which competency?

4. 3. Security teams and what each focuses on Predict 10 min

   Purpose: Describe the SOC, the incident response team and DevSecOps.

   Ask

   • Which team responds?
   • Does a SOC prevent breaches?
   • Why build security in from the start?

   Responses to expect

   • Many think the SOC fixes incidents.
   • On screen in turns: the opening; then three teams, with their memory aids held back; the memory aid for each; the check question on which team responds, and its answer; the Security Operations Centre; the question on a SOC and a breach, and its answer; buying monitoring as a service; the incident response team; the check question on containment, and its answer; CIRT, CERT and CSIRT; DevSecOps; the question on reviewing at the end, and its answer; why building in beats reviewing at the end.

   Misconceptions to challenge

   • A learner may believe: “The SOC fixes incidents.” Respond: It watches and escalates; the response team leads.
   • A learner may believe: “CIRT and CERT are different teams.” Respond: Different names for the same kind of team.
   • A learner may believe: “DevSecOps is a tool.” Respond: It is a way of working.

   If the explanation does not land: Use a fire service: the alarm monitoring centre watches, the crews respond, building regulations build safety in.

   In the lesson window

   • Check your understanding: Which team’s memory aid is “responds”?
   • Think it through: A company runs a SOC around the clock. Can it still suffer a breach?
   • Check your understanding: Disconnecting an infected computer from the network is an example of what?
   • Think it through: Why might it be cheaper to build security into software from the start than to review it at the end?

5. 4. A role is not a team Explain 4 min

   Purpose: Separate individual roles from teams.

   Ask

   • Ask whether the ISSO is a team.

   Responses to expect

   • Some say yes.
   • On screen in turns: the opening; then the check question on whether the ISSO is a team, and its answer; two questions that keep roles and teams apart; which group; all six memory aids together.

   Misconceptions to challenge

   • A learner may believe: “The ISSO is a department.” Respond: It is an individual role.

   In the lesson window

   • Check your understanding: Is the ISSO a team?

6. 5. One change, six contributions Predict 7 min

   Purpose: Follow one cloud move through every role and team.

   Ask

   • What does each contribute?

   Responses to expect

   • The CIO and CISO are often merged.
   • On screen in turns: the opening; then the question on a move to the cloud, and its answer; one change, six contributions, starting with the CIO; the CISO or CSO; DevSecOps; the ISSO; the SOC; the CIRT or CERT.

   Discussion pause: Reveal the six contributions one at a time; before each, ask the class what that role or team would do for this change.

   To go further

   • Which contribution would you expect to start first, and which never to finish?

   In the lesson window

   • Think it through: An organisation moves its customer service system to a cloud platform. Using the six roles and teams, suggest what each might contribute.

7. 6. How the teams hand over Predict 6 min

   Purpose: Show the hand-overs and what goes wrong at them, including in small organisations.

   Ask

   • What goes wrong if the SOC does not pass it on?

   Responses to expect

   • Nobody starts the response.
   • On screen in turns: the opening question, its answer; then three hand-overs, starting with the SOC; incident response to the builders; upwards; one alert, three hand-overs, starting with the SOC; the response team takes charge; the lessons reach the builders; the result; hand-overs are where things go wrong; in a small organisation; the first step in the chain.

   In the lesson window

   • Think it through: The SOC confirms an incident at 2 a.m. but does not pass it on. What goes wrong?

8. 7. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The mouse tests escalation; the small firm tests work without titles; the manager tests SOC and CIRT.
   • On screen in turns: the opening; then the question on a mouse moving by itself, and its answer; the question on a ten-person firm, and its answer; the question on the SOC leading recovery, and its answer.

   In the lesson window

   • Apply it: A user tells the service desk that their mouse pointer is moving by itself. What is the service desk’s part?
   • Apply it: A ten-person firm has no SOC, no incident response team and no DevSecOps team. Does the work disappear?
   • Apply it: A manager expects the SOC to lead the recovery after a confirmed ransomware attack. What is the better arrangement?

9. 8. Check your understanding Check 6 min

   Purpose: Check the lesson against the approved revision-bank questions.

   Ask

   • Answer individually, then compare before revealing.

   Responses to expect

   • The team questions link to the teams step.
   • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

10. 9. What to remember Consolidate 4 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the three teams’ memory aids.

    Responses to expect

    • Watches, responds, builds securely.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

11. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Seven connected competencies.
    • Watch, respond, build securely.
    • Roles are people; teams are groups.
    • One change touches everyone.
    • Mind the hand-overs.

Consolidation

• Seven connected competencies.
• Watch, respond, build securely.
• Roles are people; teams are groups.
• One change touches everyone.
• Mind the hand-overs.