The perfect SOC: How to boost defences

A deluge of alerts combined with escalating cyber threats is challenging modern security operations centers (SOCs). Yet there is a huge gap between the best and worst organizations’ SOCs, according to a recent advisory from the US Cybersecurity and Infrastructure Security Agency (CISA).

The agency has illustrated its findings after conducting red team assessments at two organizations, which led to very different results. While both were compromised as part of the tests, one failed to detect or contain the activity, but the other quickly identified initial compromise attempts, isolated affected systems, and forced the red team into an ‘assume breach’ model.

The detection and response gap between the two organizations “had nothing to do with tools or maturity”, says Crystal Morin, senior cybersecurity strategist at Sysdig. “Both organizations faced comparable attacks and triggered similar alerts, but organization A lost them in a sea of noise.”

In contrast, organization B’s fine-tuned system cut through the noise to allow analysts to spot and act on anomalous activity in minutes. “Ultimately, organization B was able to stop the red team activity because it had the right approach to baselines and triage,” Morin tells IT Pro. “It knew what good behavior looks like, and what steps are out of line.”

Halting attacks

CISA’s test shows that a robust SOC can help halt an attack even after an adversary has compromised an organization.

Martin Riley, CTO at Bridewell, describes how organization B, operating in the water sector, detected each payload from the phishing emails as it executed and isolated the affected workstations, taking up to 20 minutes to contain the threat. “Command and control was also disrupted before the intrusion could move further,” says Riley.

It comes at a time when SOCs are drowning in alerts, making it challenging to keep up. Security analysts are forced to spend 68% of their day on reactive alert triage and manual data gathering, leaving little time for proactive threat hunting, according to a new report by ExtraHop.

As CISA’s report reveals, modern SOCs are learning that traditional network monitoring and high alert velocity can “quickly become overwhelming” for human analysts and security teams, says Debby Briggs, vice president and chief information security officer at NETSCOUT.

CISA’s tests revealed that organization A’s SOC suffered from alert fatigue, with a high volume of either false positive or low-value alerts triggered by normal business operations. “This is a relatively common SOC issue and results in a signal-to-noise problem, where high-value alerts get drowned out and go unnoticed,” says Chris Oakley, SVP Assurance Services, Americas, LRQA.

In one instance, an alert triggered by the red team was closed as a false positive because no one in the SOC could work out who owned the affected server. This is “a common story of technology not being the limiting factor”, says Oakley.

Robust detection engineering practices combat this, but it’s “not glamorous work” and “requires constant iteration”, he says.

A lot of the weaknesses CISA found are familiar, according to Cyrille Badeau, VP, EMEA, at Securonix. “Some controls were in place, but they were not configured or tuned well enough to help the SOC at the point of investigation. Environments get larger, new applications are added, people change roles, and service accounts stay in place for years. The security team ends up looking at activity without always knowing what normal behavior should look like for that account or system.”

Tool sprawl adds “another level of complexity”, according to Badeau.

Lessons for all

The two organizations tested by CISA were operating in critical sectors. However, the report’s findings are applicable to SOCs more widely, experts say.

Learning from the findings, Oakley highlights some “widely applicable quick wins”, such as ensuring cloud keys have expiry dates, checking cloud application permissions, and removing passwords from text files. “These things don’t necessarily need technology or a sizable budget and are achievable through time and mandate.”

The operational lessons can apply to any organization’s network, according to Briggs. She believes firms should consider transitioning from manual triage to learning from past incident resolution patterns and automating incident response tasks.

Most importantly, the right metrics must be prioritized, says Oakley. “Alert volume and ticket count pale in comparison to mean time to containment, in terms of real-world efficacy. Beyond that, having a unified area of visibility across areas such as endpoints, identity and cloud is key, especially with identity becoming the primary attack surface.”

At the same time, analysts must have authority to act, says Oakley. “It’s no good having a team who can tell you something bad is happening but are unable to do anything about it."

Oakley also advocates “solid fundamentals” such as detection engineering to reduce alert fatigue and “other human failures”. The ideal SOC is “set up in a way that harmonizes people, process, and technology”, he says. “Tooling is rarely the primary weakness in a SOC.”

Automation also earns its place in the SOC. “As CISA noted, it speeds up token revocation, because manual processes are too slow when a threat is active,” says Morin. “It also makes just-in-time access reviews practical, so excessive access like administrative rights can be removed or re-provisioned automatically.”

However, while useful, she points out that automation cannot replace human investigative instinct. “No amount of automation or tooling will understand when something isn’t quite right, and you need to dig a little deeper, as organization B did after cutting off the red team’s command and control infrastructure.”

At the same time, firms need to assume that whatever is working today will always require tuning, according to Badeau. “Cloud estates, identities and applications change, and attackers adapt. Regular scheduled exercises give teams a way to see where detections have weakened, where context is missing, and where response has become slower,” he says.

“No SOC is future-proof, but a good SOC should be able to keep learning its own environment and adjust as threats change.”