Speaker
Description
Switch has been working on building a strong and resilient Community around its SOC offering for the last 2.5 years. Starting out with an idea, a few customers and many requirements from them, it has grown to a 20+ members strong community of Swiss higher institutions with 2 universities onboarded to a MS Sentinel based SOC Service, 2 universities where Switch analysts assists in the day to day operations of the respective security teams and 5 smaller institutions where Switch handles critical MS Defender incidents (the so called “SOC Light”). The process from starting with nothing to running operations has been quite a difficult journey, mainly because we weren’t sure what our service offering actually should be and how we should approach the wide variation in size, maturity and security know-how of the different universities and institutions. They are ranging from institutions with 200 FTEs with no dedicated security personnel up to the largest technical university in Switzerland with over 10’500 FTEs and a security team of 12.
By identifying customer personas like CISO or Security Engineer, describing their pain points and breaking down an initially unstructured service offering, we designed a structured customer journey that takes into account the existing environment and maturity of the customer, and maps out a strategic roadmap of which services can be deployed in the future and what additional value they will bring to the security posture of the institutions. In addition, it gives us a roadmap for service development and deliver and allows us to focus on solving one problem at a time, lessening the risk of developing the wrong solution.
In this talk we will present the journey, how it was built and how it can serve as the blueprint for other NRENs or SOC Service providers to structure their own customer journey. Additionally, we will share how the uptake within the community has been and what we have learned over the last 9 months after initial launching it.
This 20-minute presentation is targeted at NRENS or SOC Service providers that provide SOC services.