Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

4/23/2018
09:35 AM
Alan
 Zeichick
Alan Zeichick
Alan Zeichick
50%
50%

It's the People: 5 Reasons Why SOC Can't Scale

There are always more security alerts and threats to respond, but the answer isn't to simply throw more money at the SOC to hire additional Tier 1 and Tier 2 security analysts.

SAN FRANCISCO -- Blame people for the SOC scalability challenge. On the other hand, don't blame your people. It's not their fault.

The security operations center (SOC) team is frequently overwhelmed, particularly the Tier 1 security analysts tasked with triage. As companies grow and add more technology -- including the Internet of Things (IoT) -- that means more alerts.

As the enterprise adds more sophisticated security tools, such as Endpoint Detection and Response (EDR), that means more alerts. And more complex alerts. You're not going to see a blinking red light that says: "You're being hacked." Or if you do see such an alert, it's not very helpful.

(Source: iStock)
(Source: iStock)

What's the problem? It's the people, say experts at the RSA Conference, which wrapped up last week. The SOC team -- or teams -- simply can't scale fast enough to keep up with the ever-increasing demand. Let's talk about the biggest problems challenging SOC scalability.

Reason #1: You can't afford to hire enough Tier 1 analysts
You certainly can't afford the Tier 2 analysts who respond to real -- or almost certainly real -- incidents. According to a quick glance at sites like Glassdoor and Indeed, be prepared to pay over $100,000 per month, per person. Reason #2: You can't find the analysts; there's not a huge talent pool
"We've created a growing demand for labor, and thus, we've created this labor shortage," said Malcolm Harkins, chief security and trust officer of Cylance.

There are huge numbers of open positions at all levels of information security, and that includes in-enterprise SOC team members. Sure, you could pay more, or do competitive recruiting, but go back to the previous point: You can't afford that. Perhaps a managed security service provider can afford to keep raising salaries, because an MSSP can monetize that expense. An ordinary enterprise can't, because security is an expense.

Reason #3: Team training is a never-ending journey without a happy ending
Even with the best security tools, being an analyst requires constant training on threats and techniques -- which is expensive to offer, especially for a smaller organization. And wouldn't you know it, as soon as you get a group of triage specialists or incident responders trained up nicely, off they go for a better job. Reason 4: Collaboration is tough for incident handoffs to the next analyst
Rishi Bhargava, co-founder of Demisto, pointed out that around-the-clock, follow-the-sun security, with investigations and incident response, brings its own challenges, particularly during shift changes.

"Collaboration, along with all the skill set problems, is a real problem," Bhargava said. "How do you do the handoff? How does the collaboration happen? How do you ensure that everyone has the right context to advance the investigation?"


The fundamentals of network security are being redefined -- don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual Big Communications Event. There's still time to register and communications service providers get in free!

You can't send the next shift team an email explaining the status of today's incidents, he added, and hope an analyst can pick up it up at the start of his or her shift.

Reason #5: Security management can't scale either
There's alert fatigue for the Tier 1 and Tier 2 analysts, but the problems go all the way up the food chain.

"There's decision-maker dementia for the executives, who are pulled in too many different directions with competition priorities -- and they can't figure out how to scale either," said Cylance's Harkins. There are too many risks that senior analysts and management must address, contain or stop, for the good of the company.

It's not their fault
Go ahead, blame the analysts, and security managers, for not handling an ever-increasing workload, while fighting alert fatigue, knowing the next incident might be a Target-sized, or Equifax-sized, data breach. The real challenge is to find more resources, including better tools, practices and procedures, for scaling the SOC.

Because you can't simply throw more people at the problem.

Related posts:

— Alan Zeichick is principal analyst at Camden Associates, a technology consultancy in Phoenix, Arizona, specializing in enterprise networking, cybersecurity, and software development. Follow him @zeichick.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises Are Assessing Cybersecurity Risk in Today's Environment
The adoption of cloud services spurred by the COVID-19 pandemic has resulted in pressure on cyber-risk professionals to focus on vulnerabilities and new exposures that stem from pandemic-driven changes. Many cybersecurity pros expect fundamental, long-term changes to their organization's computing and data security due to the shift to more remote work and accelerated cloud adoption. Download this report from Dark Reading to learn more about their challenges and concerns.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-21690
PUBLISHED: 2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components ...
CVE-2022-21692
PUBLISHED: 2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions anyone with access to the chat environment can write messages disguised as another chat participant.
CVE-2022-21694
PUBLISHED: 2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this...
CVE-2022-21700
PUBLISHED: 2022-01-18
Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used ...
CVE-2022-21691
PUBLISHED: 2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.