CRESTCon Europe 2024 - The ‘Thinking’ Analyst: Unlocking Core AnalysisSkills

### Overview In this presentation from CRESTCon Europe 2024, Michael, the SecOps and Incident Response Lead at Precursor Security, addresses the critical non-technical competencies required of SOC analysts. Drawing inspiration from the military concept of the "thinking soldier," Michael highlights a pervasive industry challenge: analysts often default strictly to toolsets, query cheat sheets, and rigid playbooks rather than developing sound investigative mindsets and analytical reasoning.

### Key Topics - **Mindset vs. Playbooks:** While playbooks provide standardization, treating investigations like a conveyor belt limits effectiveness. Analysts should instead rely on flexible guides and analytical frameworks to reason through alerts. - **Cognitive Biases:** Investigations are frequently undermined by perception bias, evidence bias (such as over-relying strictly on EDR process trees rather than pivoting across secondary data sources), and unrealistic SLAs that force hasty decisions without adequate context. - **Dual-Process Theory:** Applying intuitive (System 1) versus deliberate (System 2) thinking models to triage. While experienced analysts leverage intuition, unexamined System 1 thinking can introduce bias. Deliberate System 2 thinking should be systematically engaged during investigations rather than reserved merely for post-incident reviews. - **Information Handling and the OODA Loop:** Managing continuous data streams requires externalizing notes visually and understanding the OODA (Observe, Orient, Decide, Act) loop. In complex scenarios, teams often stall at observation and orientation due to low confidence, failing to reach decisive actions. - **Communication and Reporting:** Effective verbal and written communication requires tailoring content to stakeholders. Core writing principles include Keep It Simple Stupid (KISS), Bottom Line Up Front (BLUF), and the College of Policing's ABC (Accuracy, Brevity, Clarity) standard.

### Technical Details - **Alert Deconstruction:** Analyzing an alert such as "known malicious binary executed on Mike's laptop" reveals rich context prior to querying—identifying threat intelligence reliability, binary characteristics, and endpoint host context to inform containment scope. - **Analytical Frameworks and Heuristics:** - *Occam's Razor* and *Hanlon's Razor*: Differentiating intentional adversary activity or human operational mistakes from malice. - *Alexiou Principle*: A digital forensics approach centering on four questions: what question needs answering, what data is required, how to extract it, and what the findings conclude. - *OODA Loop*: Highlighting the need to accelerate the cycle from observation/orientation to decision-making and containment. - *Aviation Safety Parallels*: Referencing Skybrary to demonstrate how operational fatigue, workload, and tone impair verbal communication in high-stakes environments.

### Takeaways - **Adopt Deliberate Investigative Questioning:** Use resources like the DFIR Investigative Questions (DFIQ) project to establish structured questions rather than executing queries blindly. - **Conduct Robust QA and Debriefs:** Implement objective quality assurance checks on ticket handling and ensure post-incident lessons-learned roundtables occur rather than shelving final reports. - **Gamify and Standardize Skills:** Map career pathways to the NIST NICE framework and exercise analytical decision-making using tabletop simulations such as Black Hills Information Security's *Backdoors & Breaches* card game. - **Practice Clear Communication:** Use techniques like "rubber ducking" to validate findings before delivering narrative-driven, factual incident reports.