Episode 210: The CIS SOC — Keeping Security Operations Human
In episode 210 of Cybersecurity Where You Are, Sean Atkinson speaks with Patrick Cooper, Security Operations Center (SOC) Analyst II at the Center for Internet Security® (CIS®), and Nathaniel Ludke, SOC Analyst II at CIS. Together, they take listeners inside the 24x7x365 CIS SOC, from alert prioritization and severity-based escalation to member reporting and the use of artificial intelligence (AI) for open-source intelligence, packet analysis, and SQL querying. They explain why AI is the tool and the human is the loop for U.S. State, Local, Tribal, and Territorial (SLTT) government members of the Multi-State Information Sharing and Analysis Center® (MS-ISAC®).
Here are some highlights from our episode:
- 01:20. What a typical shift for a CIS SOC analyst looks like
- 03:29. Challenge: Supporting members while minimizing overwhelm and stress
- 06:25. Common indicators of compromise (IOCs) as impetus to take a deeper look
- 07:01. Prioritization: First in first out with a few noteworthy exceptions
- 07:41. How severity of an alert affects the CIS SOC's communication with members
- 08:51. The typical path of escalation for alerts
- 09:36. Hot IP entries and agency notes inform false-positive judgments
- 10:42. Designating the severity of false positives
- 14:09. Automated (monthly), manual, historical, and other types of reports from the CIS SOC
- 17:01. No news is good news? Why MS-ISAC members both welcome and worry about silence from the CIS SOC
- 18:01. The CIS SOC's use of AI for open-source intelligence and information gathering
- 20:07. Human is the loop: How AI supports packet analysis, SQL querying, and more
- 22:20. AI enablement, not replacement: Keeping security operations human
- 23:42. How AI can function as an additional security threat
- 25:23. Hallucination risk and the SOC analyst “spidey sense”
- 26:25. Relationships with MS-ISAC members: The "lost art" of knowing when something's off
Resources
- The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
- CIS Cyber Incident Response Team
- CIS Cyber Threat Intelligence Team
- Cybersecurity Services
- You Have a Cybersecurity Incident. Now What?
- Episode 190: Separating Mythos AI Fact from Fiction
- CIS Controls v8.1 Incident Response Policy Template
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].
As of June 23, 2025, the MS-ISAC has introduced a fee-based membership. Any potential reference to no-cost MS-ISAC services no longer applies.
