Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

10/21/2019
10:30 AM
Todd Thiemann
Todd Thiemann
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

SOC Operations: 6 Vital Lessons & Pitfalls

There is no one road to security operations success, but these guidelines will smooth your path.

Today's modern security operations centers (SOCs) face a variety of challenges, ranging from organization and structure to technology and budgets. Third-party SOCs (such as Arctic Wolf, and other companies) are responsible for detecting and responding to threats, leaving the organizations that rely on them to focus on improving internal security operations. Here are six vital lessons about SOC effectiveness that we have learned in our operational journey with customers.

Lesson #1: Locate and Retain High-Quality SOC Talent
Finding good SOC analysts is difficult in the best of times and is particularly challenging in the present growth economy, where talent is scarce. Organizations need smart people to understand the threat surface, interpret security telemetry, and find and analyze threats. Today's latest artificial intelligence (AI) and machine learning innovations will help these professionals operate more effectively. However, technology alone will never replace smart people who understand a company's specific environment and threats. Organizations need to implement the right programs to locate, train, and retain the good people.

Lesson #2: Improve Your SOC Incrementally
The "big bang" theory of ramping up SOC operations is fraught with risk and has a high probability of failure. Organizations need to take time to analyze what they do well, then build from there. Incremental improvement always wins out over grandiose projects. 

Lesson #3: Coordinate SOC and Network Operations
Integrating your SOC and network operations center (NOC) will greatly improve success across the board. A NOC manages, controls, and monitors networks for things like availability, backups, ensuring sufficient bandwidth, and troubleshooting network problems. A SOC provides incident prevention along with detection and response for security threats. The two functions can overlap when, for example, events like a denial-of-service attack might manifest itself as a network outage but is in fact a security threat. While the two functions can be organizationally discrete, they need to coordinate to achieve an optimal outcome.   

Lesson #4: Realistic Goals
It's critical for organizations to be realistic about what they want to achieve and clear-eyed on how to achieve it. Your first step: Get executive support, and then determine how much the effort will cost. This exercise includes thinking through all of the pieces you'll need to put in place to establish an effective SOC, including people, processes, and technology. You will also face "build versus buy" decisions that will require a process for evaluating the best approach for your organization's specific goals.

Lesson #5: Staffing Delusions
Consider the security challenges that your business faces, and then staff at an appropriate level to address those challenges. Referring to your two or three security professionals as "my SOC" is not the optimal solution. A handful of people will struggle to provide the 24x7x365 coverage required for an effective operation. Furthermore, relying on alerts sent to phones during off hours is a risky recipe for success when that middle-of-the-night alert beeps while someone is asleep. The "Gartner 2018 Market Guide for Managed Detection and Response Services" suggests that the minimum needed to provide 24x7x365 coverage is eight to 12 analysts. Consider what happens when an incident occurs when your staff is at home celebrating on New Year's Eve and there isn't eyes-on-glass coverage. 

Lesson #6: The "AI Cure-All" Fallacy
AI will not solve all of a business's security problems, and organizations cannot automate their way out of the security monitoring challenge. Maintaining a well-functioning SOC requires finding, training, and retaining experienced personnel who can leverage sophisticated tools with AI to identify the threats that matter by providing feedback from which automation can learn. The major challenge in finding and retaining these professionals is in providing them with a variety of interesting and challenging work.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Surviving Alert Fatigue: 7 Tools and Techniques."

Todd Thiemann is responsible for product marketing at Arctic Wolf Networks.  He is an information security veteran with over a decade of information security experience across a range of subjects including malware detection, SIEM, encryption, key management, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36289
PUBLISHED: 2021-05-12
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and fro...
CVE-2021-32606
PUBLISHED: 2021-05-11
In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
CVE-2021-3504
PUBLISHED: 2021-05-11
A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to...
CVE-2021-20309
PUBLISHED: 2021-05-11
A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to ...
CVE-2021-20310
PUBLISHED: 2021-05-11
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this...