Diagnosis SOC-Atrophy: What To Do When Your SOC Is Sick
•
1 like•360 views
The document discusses diagnosing and treating a sick security operations center (SOC). It identifies common symptoms of a sick SOC including alert fatigue, high staff turnover, and long adversary dwell times. The document outlines steps to improve SOC maturity, such as eliminating alert fatigue through threat intelligence-led detection, implementing a living incident response plan, and continuous process improvement to reduce adversary dwell times. The goal is to evolve the SOC along a maturity curve to a healthy state characterized by intelligence-led approaches, continuous learning, and short dwell times.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Diagnosis SOC-Atrophy: What To Do When Your SOC Is Sick
Similar to Diagnosis SOC-Atrophy: What To Do When Your SOC Is Sick (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
Diagnosis SOC-Atrophy: What To Do When Your SOC Is Sick
- 1. SESSION ID:SESSION ID: #RSAC Tony Cole Diagnosis SOC-Atrophy: What To Do When Your SOC Is Sick AIR-W11 VP / Global Government CTO FireEye @nohackn
- 2. #RSAC Apply: Fixing Your Sick SOC 2 Educate + Learn = Apply This knowledge can be applied at your organization to make your SOC work Take every session at RSA as a learning opportunity and then apply those principles! Attendees will learn how to identify a sick SOC and take the steps to heal it I’m here to provide the principles on how to make your SOC more effective
- 3. #RSAC Adversaries Continue to Evolve TTPs 3 Data Loss Filtering URL Filtering Anti-spam, Anti-spyware Anti-malware Trojans Worms, Bots Spyware Spam Grey-listing Behavioral Analysis Heuristics Whitelisting Rootkits PhishingZero-days 1990s 2000s 2010s Offense Today Defense Opportunistic Targeted Detonation Chambers Intelligence APTs Melissa CodeRed Birth of AntiVirus Mobile Threats IoT Threats Ransom- Ware Lots of New Stuff
- 4. #RSAC Has Your SOC Evolved With Them? 4 It’s unlikely if it looks like this one. If it does, go home, you’re in the wrong line of business.
- 5. #RSAC Symptoms of a Sick SOC 5 • Alert fatigue for your analysts • Causes high staff attrition rates • Continuously reimaging systems • Not identifying the cause of the breach • No updates to IR plan or associated processes • Long adversary dwell times • Limited capability (and typically unaware of it)
- 6. #RSAC SOC Maturity Curve 6 Sick SOCs sit here
- 7. #RSAC Real-Life Sick SOC Examples 7 • High turnover • No Cohesive process • Little ROI • No Orchestration • Little Automation • No Hunting People Technology Process • Reactive to Alerts • Focus on Closing Tickets • Resolution without Comprehension • Alert Centric • Lengthy Dwell Times
- 8. #RSAC How Do We Climb the Maturity Curve? 8
- 10. #RSAC Eliminate Continuously Reimaging Systems 10 Reimage the machine Identify the actions of the attacker, the scope of the compromise, the data loss, the steps required to remove the attacker, and the approach required to re-secure the network utilizing threat actor intelligence Old Malware Focus New Attacker Focus
- 11. #RSAC Implementing A Living IR Plan 11 • Clearly defined roles & responsibilities with organizational alignment & training to follow workflow • Feedback loop to re-evaluate SOC/IR processes, use-cases on an on- going basis • Monitoring and operational framework is documented, updated and easy to access
- 12. #RSAC Implementing A Living IR Plan 12 • Correlates internal threat data with threat intelligence from multiple sources • Cooperation across all orgs and effective communication at all levels • Has executive support and sponsorship from the very top • Support for Hunting in the environment at the Network and Endpoint level to warrant out all beachheads established during compromise
- 13. #RSAC Eliminate Adversary Dwell Times 13 Update your detection methods with an adversary intelligence led focus Create partnerships with law enforcement, vendors, CERT organizations Share threat data, analyze and consume threat data Continuously learn and implement new processes *Dwell Time is the amount of time an adversary spends in your enterprise after the compromise before being detected
- 14. #RSAC SOC Maturity Curve 14 Get your SOC to this level
- 15. #RSAC Healthy SOC Examples 15 • Application Knowledge • ROI for IT and Business • Continuous Process ImprovementPeople Technology Process Continuously Evolve • Hunting for IOCs • Network and Endpoint IOC Focus • Intelligence Led Approach • Threat Containment • Short Dwell Times
- 16. #RSAC Apply –Do These Five Things 16 Get an independent assessment Review and utilize best practices Solve analyst fatigue Continuous Process Improvement Institutionalize the fact that proper cyber security is a marathon