As a SOC manager, you may need to start thinking about remote works for several reasons: Office move, larger talent pool, disaster recovery plan. Some scenarios may be short term to midterm solutions, here are some initial concerns I came up with when thinking about the problem.

Concern 1: Speed of responding

You IR team has to be able to complete its mission of detection and responding so will you be able to be at least able to this task.  A lot of this depends on the toolset you have deployed. If you are using a tool like GRR or others that have a web interface, it makes a response on a more limited system easier. If your typical analysis starts with physically going to someone’s desktop without having an agent pre-deployed, then you will need to have someone be your “Hands” and get the data to a place where it can be analyzed.

Concern 2:Physical security at home office

A responders house typically doesn’t meet all the needs of many compliance/corporate policies.  You could require anyone that works remotely have to meet these requirements, or you will have to provide an option to remote into hardware that will not allow data to be copied out.  Virtual desktops or hardware desktops that are setting in the data center might make more since.  Having a server VM with the SANS SIFT might be a viable options to perform most of the analysis.

Concern 3: Secure access

SOCs typically have a very stringent access, so you need to make that you have appropriate controls. You may need to require individuals get a static IP from their ISP.  Obviously, multi-factor into the environment is a must.  

Concern 4: Collaboration and Mentoring

If your team will be remote for a short time, them building a strong comradery remotely is not a big deal, but if it permanent this can be a challenge.  Having a short dedicated meeting in the morning to discuss topics will help.  Training up IR staff is a little harder, have dedicated time where you have the analysist share their desktop and walk through the current incident they are working.

What concerns do you have and how have you addressed them?

--

Tom Webb