Much the same way that nursing teams need to share patient healthcare updates when their shift ends, security operations centers (SOC) need to have smooth shift-handoff procedures in place to ensure that continuous monitoring of their networks and systems is maintained.

Without proper planning, knowledge gaps can arise during the shift-change process. These include:

• Incomplete details: Updates, such as the work that has been done to address active incidents and the proposed duties to continue these efforts, are not thoroughly shared.
• Incorrect assumptions: Operating with fragmented information, teams engage in repetitive tasks, or worse, specific investigations are skipped entirely because it is assumed they were completed by another shift.
• Dropped tasks: From one shift to the next, some tasks can fall entirely through the cracks and are never reported to the incoming personnel.

Because of these gaps, security analysts tend to spend too much time following up with each other to ensure items are completed. With major incidents, this may mean keeping personnel from the previous shift on for a partial or even full second shift until the incident is closed out. Ramifications of being overworked can include physical and mental fatigue and even burnout.

Fortunately, these gaps are not inevitable.

Getting a process in place

Decide on the basics

Before you can succeed with shift handoffs, you need to decide how you will design your shifts.

• Will shifts be staggered?
• Will they be covered from geographically different regions (i.e. “follow the sun” model)? If so, handovers may be challenged by language and cultural differences.
• Do you allow for people to swap shifts (i.e. work the early shift one week and the graveyard the next)?

If shifts are fixed then you can create shift teams. If shifts rotate, you need to ensure analysts work each shift for a set period of time to adapt to the specific types of cases and ancillary work that each shift is responsible for. Rotating shifts also can infuse a fresh set of eyes to processes or problems. It also may help retain talent, as working consistently irregular hours can have a negative impact on one’s health.

Properly share communication

When you work in a SOC, you don’t punch in and out like in the old factory days. Active cases may require you or someone from the team to arrive early to receive a debriefing, or stay late to deliver your own to arriving colleagues (as well as complete any pending paperwork). Streamlining the transfer process is critical but simple: Create a standard handoff log template that each shift uses to clearly communicate tasks and action items. Be prepared for questions.

Log activities

Security orchestration, automation, and response (SOAR) technology can help in the collaboration process. In addition, SOAR gives managers the ability to automatically assign cases to the appropriate analyst. Through playbooks, escalations can be defined and automated based on the processes that are unique to your organization.