Before 2019, Cal Poly CISO Doug Lomsdalen had to handle the suspicious-login alerts coming from his security information and event management (SIEM) tool largely by himself.
Since then, Lomsdalen has added some help: Students.
Colleges are turning to undergrads to field notifications from security operations centers (SOCs). Students in the SOC can get a taste of cybersecurity professional life while reducing IT costs and CIO effort.
“They can allow my staff, myself, to be addressing more strategic and operational things while they’re dealing with the alerts,” said Lomsdalen.
A SOC, inside-out. A security operations center proactively monitors for incidents, often indicated by the SIEM tools. The SIEM monitors network-connected products, like firewalls and email, to address cyberthreats, of which universities have plenty.
A report from the cybersecurity firm Check Point found that the most attacked industry in Q3 2022 was the education/research sector, averaging 2,148 weekly attacks, an 18% year over year increase.
The Cal Poly “junior security operations center analyst” is expected to work between 10–16 hours per week during the school year. The so-called “learning SOC” provides the students an opportunity to learn real-world tools, like their go-to SIEM product Splunk Enterprise Security, and to address questions as they arise:
Is a faraway sign-on attempt, for example, from a hacker or a senior on spring break?
Identity-and-access-management logs reveal a path for the cybersecurity newbie to solve. “That’s the art part of doing an analysis. It’s not always strict rules that you can follow. You have to look at the context of the logins,” said Lomsdalen.
Read more here.—BH
Do you work in IT or have information about your IT department you want to share? Email [email protected].
