CS1701

security operations centres
Hewlett Packard Enterprise
Discover 2016 London.
In a few instances, organisations have
gone as far as opting for open hunt as the
sole means for detection and response,
while eliminating SIEM-based real-time
monitoring efforts. Many of these
organisations were frustrated by security
operations that were difficult to staff and
not producing the expected value, and thus
decided to try something new. The result?
Much of the same.
"Searches that return data from
misconfigured applications and systems, but
not much in terms of useful results about
threats to the organisation," reveals HPE.
"The maturity of these organisations actually
regressed and risks increased, as response to
known-bad threats slowed and decreased in
consistency. In most cases, the operational
context of the previous solution was lost in
the transition to a new approach.
EARLY ADOPTION OUTCOMES
While most organisations in the early
adoption phase of this emerging area of
security operations are experiencing mixed
results, there are some that have successfully
added threat hunt capability to their security
programs in complimentary ways to existing
real-time operations.
"HPE is working with organisations that
have leveraged the mature methodologies
that made their SOC programs successful
and expanded those lessons learned into
threat hunt."
Here are some other key observations from
HPE's findings:
Complete automation is an unrealistic
goal. A shortage of security talent
remains the number one concern for
security operations, making automation
a critical component for any successful
SOC. However, advanced threats still
require human investigation and risk
assessments need human reasoning,
making it imperative that organisations
strike a balance between automation
and staffing
Focus and goals are more important than
size of organisation. There is no link
between the size of a business and
maturity of its cyber defence centre.
Instead, organisations that use security
as a competitive differentiator, for market
leadership, or to create alignment with
their industry are better predictors of
mature SOCs
Hybrid solutions and staffing models
provide increased capabilities.
Organisations that keep risk management
in-house, and scale with external
resources, such as leveraging managed
security services providers (MSSPs) for costaffing
or in-sourcing, can boost their
maturity and address the skills gap.
As organisations continue to build and
advance SOC deployments alongside the
evolving adversary landscape, a solid
foundation based on the right
combination of people, processes and
technology is essential. To help
organisations achieve this balance,
HPE recommends:
Mastering the basics of risk identification,
incident detection, and response, which
are the foundation to any effective
security operations program, before
leveraging new methodologies such as
hunt teams
Automating tasks where possible, such
as response automation, data collection,
and correlation to help mitigate the skills
gap, but also understanding the
processes that require human interaction
and staffing accordingly
Periodic assessment of organisations'
risk management, security and
compliance objectives to help define
security strategy and resource allocation
Organisations that need to augment
their security capabilities, but are unable
to add staff should consider adopting a
hybrid staffing or operational solution
strategy that leverages both internal
resources and outsourcing to a MSSP.
There will be great challenges ahead this
year and beyond, adds Matthew Shriner,
with further adoption of the new style of IT,
adhering to new regulations such as GDPR,
an increase in politically motivated attacks
and more. "I remain steadfast in the belief
that organisations' best defence will be to
remain steady with their security operations
foundations. Focus on the people. The
people will drive the process and the process
will ensure the most effective use of the
technologies.
"Excel at the basics and enhance capabilities
with analytics to uncover advanced attacks
with greater visibility across the organisation,
providing confidence for your business to
innovate securely," he advises.
30
computing security Jan/Feb 2017 @CSMagAndAwards www.computingsecurity.co.uk