On Tuesday, from 11 a.m. to 12 p.m., three speakers will discuss how Microsoft Corporation is moving from three brick-and-mortar operations centers in various locations around the world to one cloud-based fusion center. They will lead session 3117, “Virtual Security Operations Centers” (VSOCs).
The transition “is a work in progress,” says Michael Foynes, senior director, global operations, at Microsoft. He expects the new VSOC to be completed next year. Traditionally, he says, “we have been operating at the speed of security.” But cloud services and tools offer a different way of visualizing data, deploying software applications, and leveraging social media. “It will allow us to operate at the speed of business,” he adds.
The impetus for this change came from the security group. Michael Howard, Microsoft’s CSO, challenged the group to adopt a “mobile-first/cloud-first strategy,” which is also a company strategy, says Foynes.
In the traditional global operations centers, he notes,“We were operating in a 99 percent reactive mode.” Moving to a VSOC “enables us to be 99 percent proactive and to get in front of the business.” The difference, he explains, moves security from “waiting for something to happen to becoming an integral part of the business planning—adapting to emerging markets and building a holistic business strategy.”
While there are direct cost savings to this move, Foynes considers them to be insignificant in light of the improved level of readiness as security engages in planning and partnering across the business, moving its response capabilities to the remaining one percent. “The planning and readiness of a company has direct effect on shareholder perception and value,” he says.
Foynes admits that the transition has been a journey, and a lot of time has been invested in educating employees, “getting people to buy into something that they can’t really visualize.” The risks, he adds, are not in the new technology, operating models, processes, and procedures. But the necessary shift in mindset “changes how we communicate and engage,” he says. The goal of the education, then, is to foster integration among the groups so they understand what the change means to them, to the business, and to their partnerships.
“It really changes our role,” says Foynes. “We still have a responsibility for life safety and security, but it enables a different level of engagement with the business—and that’s really exciting!”
Foynes will be joined in this session by speakers Ray O’Hara, CPP, AS Solutions; and Brian Tuskan, Microsoft Corporation.