CS1701

security operations centres
CENTRE OF ATTENTION
SECURITY OPERATIONS CENTRES - SOCS - ARE ALL THE RAGE, IT SEEMS. BUT THEIR REPUTATION HAS
BEEN QUESTIONED, WITH REPORTS THEY ARE FALLING SHORT OF TARGET MATURITY LEVELS
With increased pressure to rapidly
innovate and align security
initiatives with business goals,
security operations centres (SOCs) provide
the foundation for how organisations
protect their most sensitive assets, and
detect and respond to threats. However,
recent findings show that the majority of
SOCs are falling below target maturity levels,
leaving organisations vulnerable in the event
of an attack.
This is according to Hewlett Packard
Enterprise (HPE), which has just published its
fourth annual 'State of Security Operations
Report' (2017), providing deep analysis on
the effectiveness of organisations' SOCs and
best practices for mitigating risk in the
evolving cybersecurity landscape.
Published by HPE Security Intelligence and
Operations Consulting (SIOC), the report
examines nearly 140 SOCs in more than 180
assessments around the globe. Each SOC is
measured on the HPE Security Operations
Maturity Model (SOMM) scale that evaluates
the people, processes, technology and
business capabilities that comprise a security
operations centre. A SOC that is well
defined, subjectively evaluated and flexible is
recommended for the modern enterprise to
effectively monitor existing and emerging
threats; however, 82% of SOCs are failing to
meet this criteria and falling below the
optimal maturity level, claims HPE. "While
this is a 3% improvement year-over-year, the
majority of organisations are still struggling
with a lack of skilled resources, as well as
implementing and documenting the most
effective processes," the company states.
"This year's report showcases that, while
organisations are investing heavily in security
capabilities, they often chase new processes
and technologies, rather than looking at the
bigger picture, leaving them vulnerable to
the sophistication and speed of today's
attackers," says Matthew Shriner, vice
president, Security Professional Services,
Hewlett Packard Enterprise. "Successful
security operations centres are excelling by
taking a balanced approach to cybersecurity
that incorporates the right people, processes
and technologies, as well as correctly
leverages automation, analytics, real-time
monitoring, and hybrid staffing models to
develop a mature and repeatable cyber
defence programme.
STRONG CONNECTION
There has never been a stronger connection
between security initiatives and business
goals, adds Shriner. "The speed of
organisations' adoption of new innovations
such as cloud, IoT and big data platforms is
matched head-on by advancement of the
attackers. The sophistication, agility and scale
of attacks has made speed an imperative for
any successful security operations centre and
has led to a renewed focus on automation,
real-time detection and response at scale.
"Along with this focus, we are continuing
to see a struggle to find and maintain skilled
resources necessary to run security
operations. Automation and outsourcing
have been utilised to ease this burden with
varying degrees of success. Throughout our
assessments, performed on six continents,
we have seen a multitude of SOC people,
process, and technology configurations. Our
28
computing security Jan/Feb 2017 @CSMagAndAwards www.computingsecurity.co.uk