Overcoming Traditional SOC Failures

A Blueprint for a Best-of-Breed SOC

A Security Operations Centre (SOC) is a centralised unit that monitors, detects, responds and prevents cyberattacks on an organisation’s assets. A SOC typically consists of a team of security analysts, engineers, incident responders and threat hunters, who use various tools and technologies to protect the organisation from cyber threats. However, not all SOCs are created equal. In our latest post, we explore these and consider how overcoming SOC failures can bring significant results.

Why a traditional SOC will fail

Many traditional SOCs suffer challenges and pitfalls that limit their effectiveness and efficiency. Some of these challenges are:

Lack of Context and Visibility

Traditional SOCs often rely on many disparate tools and data sources, such as firewalls, antivirus, network devices, endpoints, logs, feeds and alerts. However, these tools and data sources do not provide a holistic and unified view of the organisation’s security posture and threat landscape. Moreover, they do not provide enough context and correlation to help the SOC analysts understand an incident’s root cause, impact and scope. As a result, the SOC analysts have to spend a lot of time and resources on manual investigation, triage and remediation, which can lead to alert fatigue, missed incidents and false positives.

Lack of Scalability and Agility

Traditional SOCs often struggle to keep up with the increasing volume, velocity and variety of cyber threats and data. They also face difficulties adapting to the changing business needs and requirements, such as new regulations, technologies, processes and services. Moreover, they cannot automate and orchestrate their workflows and tasks, which can result in inefficiencies, errors and delays. As a result, the SOC analysts have to deal with a lot of complexity, redundancy and inconsistency, which can affect their productivity, performance and morale.

Lack of Alignment and Integration

Traditional SOCs often operate in silos, without proper alignment and integration with the rest of the organisation. They do not have a clear understanding of the business goals, priorities and risks, and they do not communicate and collaborate effectively with other stakeholders, such as IT, DevOps, compliance, legal, etc. Moreover, they do not leverage feedback and input from other sources, such as threat intelligence, vulnerability management, penetration testing, etc. As a result, the SOC analysts have a limited and narrow perspective of the organisation’s security needs and challenges, which can lead to misalignment, gaps and conflicts.

These challenges can undermine a traditional SOC’s value and effectiveness, exposing the organisation to greater risks and costs. Therefore, it is imperative to rethink and redesign the SOC model and adopt a more modern and innovative approach to overcome these challenges and deliver business-driven and valuable outcomes.

How to build a best-in-class SOC

A Best-in-class SOC is designed with engineering at the forefront and focuses on contextualising the SIEM and SOAR services based on the business needs and objectives. This should provide:

Provide visibility and context

A Best-in-class SOC leverages a single, integrated, scalable platform that can collect, analyse and correlate data from various sources and tools and provide a comprehensive and coherent view of the organisation’s security posture and threat landscape. It also enriches and enhances the data with relevant and actionable context, such as threat intelligence, asset inventory, user behaviour, business impact, etc., to help the SOC analysts understand the who, what, when, where, why and how of an incident, and to prioritise and respond accordingly.

Enable Scalability and Agility

A Best-in-class SOC utilises a cloud-based, elastic and flexible architecture that can scale up and down as needed and support the ingestion and processing of large and diverse data sets. It should also leverage automation and orchestration capabilities to streamline and optimise workflows and tasks, enabling the SOC analysts to perform faster and more accurate actions, such as detection, investigation, containment, eradication, recovery and reporting. Culturally, it also should embrace a continuous improvement and innovation mindset that can adapt and evolve with the ever-changing business and security needs/requirements.

Ensure Alignment and Integration

A Best-in-class SOC aligns and integrates with the rest of the organisation and has a clear understanding of the business goals, priorities and risks. It also communicates and collaborates effectively with other stakeholders and leverages their feedback and input to improve the security strategy and operations. It must incorporate the results and recommendations from other sources, such as vulnerability management, offensive testing, etc., to validate and verify the security controls and measures and identify and address gaps and weaknesses.

Exercitation aute laborum deserunt

Normal

Duis anim non ut qui ullamco eiusmod non amet veniam ipsum deserunt amet.

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam.

Joe Bloggs

CTO, Drax

Dolor laboris anim exercitation irure irure. Et est id sint cupidatat proident irure sint duis sunt aliqua. Amet nulla in sint tempor in nostrud pariatur pariatur sit elit occaecat non nostrud ex.

Jane Doe

CCO, Serco

Mollit labore mollit id do irure esse commodo incididunt est magna incididunt adipisicing voluptate.

Jeremy Bold

Chief of Staff, Life Search

Enim deserunt reprehenderit duis. Cillum labore veniam Lorem dolor laborum ut non dolore.

Josh Stone

Project Management, Google

Exercitation aute laborum deserunt

Parallax Headshot

Duis anim non ut qui ullamco eiusmod non amet veniam ipsum deserunt amet.

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam.

David Rabson

CEO, Acora

Nostrud do nostrud mollit. Adipisicing dolore esse non cillum eiusmod nostrud id est esse deserunt incididunt voluptate proident. Mollit irure reprehenderit proident ut occaecat eu excepteur laboris in id nulla sit nostrud.

Richard Atkins

Chairman, Acora

Adipisicing dolore esse non cillum eiusmod nostrud id est esse deserunt incididunt voluptate proident.

Gary Page

COO, Acora

FOUR decades and counting

STanding the test of time

In 1984, the cybersecurity landscape began to take shape as the digital age gained momentum. The emergence of personal computers sparked a new era of information technology, leading to increased concerns about data security and privacy.

Full Video

The HUMBLE beginnings

1989

In 1984, the cybersecurity landscape began to take shape as the digital age gained momentum. The emergence of personal computers sparked a new era of information technology, leading to increased concerns about data security and privacy.

Lorem Ipsum

1994

Nostrud irure velit ipsum laborum ut aliquip mollit excepteur nostrud ut nisi ipsum sunt voluptate amet proident magna ea laborum proident tempor irure ex ad exercitation culpa sit sunt non labore aliqua consectetur excepteur cupidatat laboris nulla id velit laborum cupidatat laboris magna qui labore excepteur do et ea veniam.

LOREM IPSUM

2000

Exercitation aliquip cillum culpa et amet non veniam velit aliqua ex exercitation sint reprehenderit labore Lorem laboris anim commodo ex quis aliquip voluptate aliquip dolor Lorem commodo irure irure ipsum incididunt velit ipsum velit voluptate irure velit excepteur dolore aute ullamco do id sit enim quis culpa Lorem exercitation qui est in ad laborum nostrud magna ut laborum voluptate proident aliqua aliqua elit exercitation velit cillum ea nulla incididunt minim veniam eiusmod elit ut laborum nulla irure magna ipsum eu minim minim eiusmod ut nulla mollit amet velit dolore excepteur amet minim fugiat quis fugiat nisi nulla nisi velit in.

Lorem Ipsum

2015

Deserunt officia in et exercitation proident consequat anim incididunt do mollit pariatur cillum id cillum velit consequat laboris labore eiusmod consectetur esse amet dolor sit reprehenderit consequat laborum consectetur ad in sunt dolor officia cillum.

What Next?

Deserunt officia in et exercitation proident consequat anim incididunt do mollit pariatur cillum id cillum velit consequat laboris labore eiusmod consectetur esse amet dolor sit reprehenderit consequat laborum consectetur ad in sunt dolor officia cillum.

An Attack Informs Defence Approach

One of the key themes that can help a Best-in-class SOC achieve these objectives is using offensive testing to inform and improve the SIEM and SOAR services and the overarching SOC capability. Offensive testing, also known as purple teaming, is the practice of simulating real-world cyberattacks on the organisation’s assets, systems and networks to identify and exploit any vulnerabilities and weaknesses and to assess the effectiveness and efficiency of the security defences and responses.

Overcoming SOC failures with Offensive testing provides a SOC with several benefits, such as:

Identifying and Prioritising the Most Critical and Relevant Threats and Risks

Offensive testing can help a Best-in-class SOC to understand the adversary’s tactics, techniques and procedures (TTPs), and to discover the most likely and impactful attack vectors and scenarios. This can help the SOC to focus on the most critical and urgent threats and risks and to allocate the appropriate resources and actions to mitigate them.

Validating and Verifying the security controls and measures

Offensive testing can help to evaluate the performance and functionality of the security controls and measures, such as firewalls, antivirus, encryption, etc., and to determine their strengths and weaknesses. This verifies whether the security controls and measures are working as intended and expected and identifies and addresses any gaps and issues.

Improving and Enhancing the Detection and Response Capabilities

Offensive testing helps the SOC to test and measure their detection and response capabilities to validate visibility gaps, detect in-depth failures and continually assess, assure and mature the alarms, alerts, rules, policies and procedures which make up the overarching SOC.

A traditional SOC is not enough to cope with the increasing and evolving cyber threats and challenges. One designed with engineering at the forefront, focusing on contextualising the SIEM and SOAR services based on the business needs and objectives will drive optimal outcomes and move the SOC from a cost centre to a business enabler.

Acora’s Managed SOC Services provide visibility and context, enable scalability and agility, and ensure alignment and integration. At the heart of this is our philosophy and approach, which uses offensive testing to inform and improve the SIEM and SOAR capabilities and the overarching SOC service by identifying and prioritising the most critical and relevant threats and risks, validating and verifying the security controls and measures, and improving and enhancing the detection and response capabilities.