Cyber Defense eMagazine January 2021 Edition

management, as well as monitoring collaboration technologies like Office 365, Teams, Zoom, and Slack.
It is about gaining visibility and control over the users’ ICT ecosystem and understanding where to, from,
and how employees are authenticating and accessing data and applications.
When an intrusion is suspected, they need to be able to qualify the threat and assess its potential impact.
They can only do that if they have captured a wide variety of activity occurring on their endpoints and
servers in real-time. Every organization should be able to search rich forensic data to understand when
and how the incident occurred, and then contain the compromise with an endpoint lockdown.
Automate Everything
While automating everything might not be possible today, SOC teams should be exploring automating
as many processes as possible. They are capturing massive amounts of data, which has made
automating security processes a necessity. Not only does it eliminate human error, it ensures that precise
decisions can be made at speed. SOC automation tools reduce an organization’s time to qualify (TTQ)
and mean time to respond (MTTR) to a security threat. TTQ refers to the average time it takes to
determine whether an incident is benign or should be considered a threat that requires
investigation. Research by the Ponemon Institute found that it took organizations an average of 280 days
to identify and contain a data breach in 2020.
For most private and public sector organizations, that “wait time” is way too long. In a risky and uncertain
time, they can’t wait for a human to perform an action that could be executed by a Security Information
and Event Management (SIEM) solution with Security Orchestration, Automation and Response (SOAR)
capabilities.
Reinventing the Wheel
When it comes to visibility and automation, there’s no reason to reinvent the wheel. SOC teams don’t
have to develop all of this themselves. Instead, they should look for one-click, out-of-the box automation
solutions that help them meet local compliance requirements and quickly deliver for their organizations.
In markets like the Kingdom of Saudi Arabia, predefined reports and use cases can be made immediately
available to organizations so they can meet local cybersecurity controls. This can be a way to quickly
enhance an organization’s security posture while being able to demonstrate compliance.
It also increases cost-efficiencies and enables local organizations to bridge skills gaps in the Middle East
and benefit from both local and global expertise. Pre-defined use cases and reports can make it simpler
and easier to deploy and enhance security in 2021.
2021 and Beyond
Rapid digitalization across the private and public sector in the Middle East is only going to continue in
2021. The digital transformation and flexible working boom that started in 2020 will accelerate. This
means that cybersecurity has to continually evolve to match the needs of rapidly changing ICT
ecosystems. Adaptability and agility are critical and that starts with a secure foundation. Throughout
Cyber Defense eMagazine – January 2021 Edition 131
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.