Security Operations & Incident Management (SOIM)

CyBOK Knowledge Area 8 · Level N2 (all Cyber Security students, both studios) · depth: know & understand the core

How you can use this topic (learning outcomes)

This topic supports the following learning outcomes, with example products you could deliver in your project:

Analysing & Advising — a short advisory note for your project client explaining how they would notice an attack on their system, and which building blocks (monitoring, a SOC, a SIEM) that would need.
Managing & Collaborating — a simple monitoring-and-response plan for your project team: what you watch, who looks at it, and what you do when something fires.

This is an orienting topic: you should be able to explain the landscape and the vocabulary. Using and building the parts in depth comes in the SOC monitoring & analysis topic (8.2-3) and the SIEM topic (8.4).

What is SOIM and why should you care?

Access control (the AAA topic) is about the locks and key cards on the doors: who may go where. But locks are never enough. A shopping centre also needs a security team: cameras that record, guards in a control room watching the feeds, a procedure for when something actually happens, and someone who works out afterwards who did it. Security Operations & Incident Management is that security team, for an IT environment.

SOIM is not about preventing access (that is AAA and firewalls). It is about detecting, analysing and responding to what gets through anyway. The core assumption is uncomfortable but realistic: prevention always fails eventually, so you need to see the intruder who is already inside and stop them. Almost every organisation now runs some form of this, because an attack you never notice is an attack you can never stop.

The engine: the MAPE-K loop

CyBOK frames security operations as a continuous loop called MAPE-K, borrowed from autonomic computing. It runs non-stop and is the backbone of everything else in this topic:

Monitor — collect traces from the infrastructure (logs, network traffic). The cameras.
Analyse — decide whether that data is evidence of an attack. The guard watching the feeds.
Plan — decide what to do about it. Ignore, investigate, or act.
Execute — carry out the response. The guard actually stepping in.
Knowledge — the stable base that feeds every step: what your systems are, what is normal, what threats exist. The playbook and the case files.

One distinction worth holding onto: events are fleeting (a single login, a packet — produced and consumed in the moment), while knowledge is stable (your asset inventory, your threat intelligence). You need the knowledge to make sense of the events.

The vocabulary you need to recognise

You should be able to explain each of these at a glance; the depth lives in the knowledgebase and the follow-on topics.

The people and places: a SOC (Security Operations Center) is the team and facility that watch continuously; the CISO is the executive who owns information security; a CSIRT/CERT is the incident-response team that acts when something serious happens; an ISAC is a sector-wide group where organisations share threat information.

The technical building blocks: an IDS (Intrusion Detection System) spots attacks and raises the alarm; an IPS also blocks them; a DMZ is a walled-off zone for your public-facing servers, separated from your internal network; a SIEM (Security Information and Event Management) centrally collects, correlates and alerts on data from across the network; SOAR (Security Orchestration, Automation and Response) automates standard responses; and CTI (Cyber Threat Intelligence) is knowledge about who is attacking and how.

Starting points

Read — CyBOK Knowledge Area 8: Security Operations & Incident Management (Debar, v1.0.2) — the authoritative source. Use section 1 for the vocabulary and the loop; the rest is reference.
Watch/read — CyBOK SOIM webinar slides — the KA walked through by the CyBOK team.
Explore — MITRE ATT&CK — the standard catalogue of real-world attacker tactics and techniques; this is the shared language a SOC uses to describe what it sees.
Study material in the knowledgebase — [TODO — !!!! Hier knowledgebase links neerzetten !!!] (Domain II → 8 SOIM: the MAPE-K loop, the vocabulary, the data sources overview.)

Points of attention (check your own work)

Use these to sanity-check how you reason about security operations in your project:

Detection, not just prevention — Have you thought about how you would notice an attack on your system, not only how to keep attackers out? Prevention and detection are both needed.
A tool is not a solution — If you name a SIEM or an IDS, have you also said who looks at its output and what they do? A tool nobody watches detects nothing.
IDS vs IPS on purpose — If you propose intrusion detection or prevention, is your choice deliberate? Detection warns; prevention blocks (and can block legitimate traffic too).
Right vocabulary, right place — Do you use SOC (the team), SIEM (the tool) and SOIM (the field) correctly, rather than as synonyms?

Going deeper (advanced)

The three loops of maturity — how security operations evolved from IDS/IPS (Monitor & Analyse), to SIEM (managing volume and Plan), to SOAR (advanced automation of the whole response lifecycle).
Cyber Threat Intelligence in depth — standards such as STIX/TAXII for ingesting external Indicators of Compromise from ISACs and CERTs.
Incident management — the human side: preparation, handling, and post-incident activities (evidence gathering, attack attribution), and the bodies involved (FIRST, TF-CSIRT, ENISA).
The convergence with safety — as security meets cyber-physical systems (medical devices, power grids), a countermeasure that reboots a system is no longer just a technical glitch but a safety hazard.

Sources and attribution

Debar, H. (2021). Security Operations & Incident Management. CyBOK Knowledge Area v1.0.2.