Posted under: Research and Analysis

Its brutal running a security operations center (SOC) today. The attack surface continues to expand, in a lot of cases exponentially, as data moves to SaaS, applications move to containers, and the infrastructure moves to the cloud. The tools used by the SOC analysts are improving, but not fast enough. It seems adversaries remain one (or more) steps ahead. There arent enough people to get the job done. Those that you can hire typically need a lot of training, and retaining them continues to be problematic. As soon as they are decent, they head off to their next gig for a huge bump in pay.

At the same time, security is under the spotlight like never before. Remember the old days when no one knew about security? Those days are long gone, and they arent coming back. Thus, many organizations embrace managed services for detection and response, mostly because they have to.

Something has to change. Actually, a lot has to change. Thats what this series, entitled SOC 2025 is about. How can we evolve the SOC over the next few years to address the challenges of dealing with todays security issues, across the expanded attack surface, with far fewer skilled people, while positioning for tomorrow?

We want to thank Splunk(you may have heard of them) for agreeing to be the preliminary licensee for the research. That means when we finish up the research and assemble it as a paper, they will have an opportunity to license it. Or not. There are no commitments until the paper is done, in accordance with our Totally Transparent Research methodology.

There tend to be two use cases main use cases for the SOC. Detecting, investigating, and remediating attacks and substantiating the controls for audit/compliance purposes. We are not going to cover the compliance use case in this series. Not because it isnt important, audits are still a thing, and audit preparation should still be done in as efficient and effective a manner as possible. But in this series, were tackling the evolution of the Security OPERATIONS Center, so were going to focus on the detection, investigation, and remediation aspects of the SOCs job.

You cant say (for most organizations anyway) there hasnt been significant investment in security tooling over the past five years. Or ten years. Whatever your timeframe, security budgets have increased dramatically. Of course, there was no choice given the expansion of the attack surface and the complexity of the technology environment. But if the finance people objectively look at the spending on security, they can (and should) ask some tough questions about the value the organization receives from those significant investments.

And there is the rub. We, as security professionals, know that there is no 100% security. That no matter how much you spend, you can (and will) be breached. We can throw out platitudes about reducing the dwell time or make the case that the attack would have been much worse without the investment. And youre are probably right. But as my drivers education teacher told me over 35 years ago, you may be right, but youll still be dead.

What we havent done very well is manage to Security Outcomes and communicate the achievements. What do we need the outcome to be for our security efforts? Our mindset needs to shift from activity to outcomes. So what is the outcome we need from the SOC? We need to find and fix security issues before data loss. That means we have to sharpen our detection capabilities and dramatically improve and streamline our operational motions. There is no prize for finding all the vulnerabilities. Like there are no penalties for missing them. The SOC needs to master detecting, investigating, and turning that information into effective remediation before data is lost.

Once weve gotten our arms around the mindset shift in focusing on security outcomes, we can focus on the how. How is the SOC going to get better in detecting, investigating, and remediating attacks? Thats where better tooling comes into play. The good news is that SOC tools are much better than even five years ago. Innovations like improved analytics and security automation give SOCs far better capabilities. But only if the SOC uses them.

What SOC leader in their right mind wouldnt take advantage of these new capabilities? In concept, they all would and should. In reality, far too many havent and cant. The problem is one of culture and evolution. The security team can handle detection and even investigation. But remediation is a cross-functional effort. And what do security outcomes depend on? You guessed it remediation. So at its root, security is a team sport, and the SOC is one part of the team.

This means addressing security issues needs to fit into the operational motions of the rest of the organization. The SOC can and should automate where possible, especially the things within their control. But most automation requires buy-in from the other operational teams. Ultimately if the information doesnt consistently and effectively turn into action, the SOC fails in its mission.

In this series, we will deal with both internal and external evolution. Well start by turning inward and spending time understanding the evolution of how the SOC collects security telemetry from both internal and external sources. Given the sheer number of new data sources that much be considered (IaaS, PaaS, SaaS, containers, DevOps, etc.), making sure the right data is aggregated is the first step in the battle.

Next, well tackle detection and analytics since that is the lifeblood of the SOC. Again, you get no points for detecting things, but youve got no chance of achieving desired security outcomes if you miss attacks. The analytics area is where the most innovation has happened over the past few years, so well dig into some use cases and help you understand how frameworks like ATT&CK and buzzy marketing terms like eXtended Detection and Response (XDR) should influence your SOC plans.

Finally, well wrap up the series by taking the what (accurate detections) and turning them into the how (effective remediation), resulting in positive security outcomes. Operationalizing is a key concept in that context. So buckle up and come along on the SOC evolution ride as we define SOC 2025.

Mike Rothman(0) CommentsSubscribe to our daily email digest

*** This is a Security Bloggers Network syndicated blog from Securosis Blog authored by [emailprotected] (Securosis). Read the original post at: http://securosis.com/blog/soc-2025-the-coming-soc-evolution

See original here:

SOC 2025: The Coming SOC Evolution - Security Boulevard