2023 SANS SOC Survey Review: Highlights and Deep Dive - Christopher Crowley [SO-CON 2024]

In its 7th year, the SOC Survey continues to be a valuable source of peer comparison for Cybersecurity Operations Centers. Christopher Crowley, Founder of Montance®, has authored this survey for each of its editions. He will provide insights, unknowns, and some details of the analysis performed to author the document of more than six hundreds SOCs surveyed.
Crowley will review key findings from the 2023 survey: SOC capabilities, funding, staffing, and challenges. He'll discuss how SOCs use Threat Intelligence, what technology gets good grades, and which technologies are failing to fulfill their promise.
After executive summary highlights of some survey findings, he'll delve into details using the public release data from the survey responses. This includes a quick fundamentals review of the setup for jupyter notebook, pandas, and seaborn.
Then, using this environment he'll discuss analysis considerations starting from data cleaning issues and moving into more advanced analysis. He'll also provide instructions and code samples that would allow attendees to answer their own questions from the released data. Attendees can download the python Jupyter notebook and data set to follow along during the presentation, or work on afterward.
The release of the survey data started from a 2018 question, when one of the readers asked something to the effect, "I work at an enormous company, and I really only want to see what other enormous companies in the financial sector answered in the survey." At the time, Crowley did some additional analysis to help answer that question. But realized that many readers likely had their own variation on that question.
This session gives you the headlines, but also the skills to get into the details if you choose. Or, you can come watch and laugh along with him as he typos his way through the python and pandas code.