The document outlines the evolution and future of Security Operations Centers (SOCs), emphasizing the importance of adapting to next-gen technologies like Security Orchestration, Automation, and Response (SOAR) alongside big data and AI. It highlights that while SOCs traditionally emphasized human monitoring, the next-gen approach integrates automation to enhance efficiency and response times to cybersecurity threats. The ultimate goal is to improve operational effectiveness while acknowledging the critical role of human analysts in managing complex threats.

1. Next-Gen Security
Operation Center
Future-Ready Protection Against Targeted Attacks
Muhammad Sahputra

2. Who..?

3. Motivation Behind Attacks Based on Stats
- March 2018
Cyber Crime & Cyber Espionage mostly motivates
hackers to launch attacks against targeted organisations

4. Cyber Kill Chain

5. – Gartner
“A security operations center (SOC) can be defined
both as a team, often operating in shifts around the
clock, and a facility dedicated to and organized to
prevent, detect, assess and respond to cybersecurity
threats and incidents, and to fulfill and assess
regulatory compliance.”
What is SOC?

6. Traditional Security
Operation Center

7. Machine Logs
192.168.2.20 - - [28/Jul/2006:10:27:10 -0300] "GET /cgi-
bin/try/ HTTP/1.0" 200 3395
127.0.0.1 - - [28/Jul/2006:10:22:04 -0300] "GET /
HTTP/1.0" 200 2216
x.x.x.90 - - [13/Sep/2006:07:01:53 -0700] "PROPFIND
/svn/[xxxx]/Extranet/branches/SOW-101 HTTP/1.1" 401 587
x.x.x.90 - - [13/Sep/2006:07:01:51 -0700] "PROPFIND
/svn/[xxxx]/[xxxx]/trunk HTTP/1.1" 401 587
x.x.x.90 - - [13/Sep/2006:07:00:53 -0700] "PROPFIND
/svn/[xxxx]/[xxxx]/2.5 HTTP/1.1" 401 587
x.x.x.90 - - [13/Sep/2006:07:00:53 -0700] "PROPFIND
/svn/[xxxx]/Extranet/branches/SOW-101 HTTP/1.1" 401 587
x.x.x.90 - - [13/Sep/2006:07:00:21 -0700] "PROPFIND
/svn/[xxxx]/[xxxx]/trunk HTTP/1.1" 401 587
x.x.x.90 - - [13/Sep/2006:06:59:53 -0700] "PROPFIND
/svn/[xxxx]/[xxxx]/2.5 HTTP/1.1" 401 587
x.x.x.90 - - [13/Sep/2006:06:59:50 -0700] "PROPFIND
/svn/[xxxx]/[xxxx]/trunk HTTP/1.1" 401 587
x.x.x.90 - - [13/Sep/2006:06:58:52 -0700] "PROPFIND
/svn/[xxxx]/[xxxx]/trunk HTTP/1.1" 401 587
x.x.x.90 - - [13/Sep/2006:06:58:52 -0700] "PROPFIND
/svn/[xxxx]/Extranet/branches/SOW-101 HTTP/1.1" 401 587
[Fri Dec 16 01:46:23 2005] [error] [client 1.2.3.4]
Directory index forbidden by rule: /home/test/
[Fri Dec 16 01:54:34 2005] [error] [client 1.2.3.4]
Directory index forbidden by rule: /apache/web-
data/test2
[Fri Dec 16 02:25:55 2005] [error] [client 1.2.3.4]
Client sent malformed Host header
[Mon Dec 19 23:02:01 2005] [error] [client 1.2.3.4] user
test: authentication failure for "/~dcid/test1":
Password Mismatch
• Application Logs
• Service Logs
• Event Logs
• System Logs

8. Security Information Event
Management
“Traditional SOC put
more weight on people
by introducing 24/7
security monitoring
activities”

9. External Data
Magic Word: Threat
Intelligence

10. People-Centric SOC
Define vision for the
team. Evaluate budgetary
/ resource concerns
First line of monitoring.
Eys-on-Glass monitoring.
Basic analysis, following
SOPs / playbooks
Actively look for loop
holes in network / system
/ configuration
Actively looking for threat
information and correlate
it with assets belong to
the organisation
Look deeper in to security
incidents. Assist in
investigating cyber
crimes
Remediate security
incidents ASAP based on
analysis performed by
security analyst
Actively dive-in to SIEM
data to look for
suspicipous activities
especially unknown
threat / zeroday
Configure, fine-
tune and maintain
SIEM solution
Second line of
monitoring.
Having more
experienced on
security analysis
Coordinate with all
team members.
Define and
document
process. Run the
operations

11. People-Centric SOC
“People-Centric SOC
introduce painful issue
to organisation”
“Don’t you think it is
inhuman to let people
watch the screen for 8
hours especially in the
middle-of night”?
“It is industry 4.0 era”

12. “Next-Gen Security Operation Center vision is to
improve technology, people, and process in
Traditional SOC”

13. Use Case: Improving MTTD-
MTTR
Define vision for the
team. Evaluate budgetary
/ resource concerns
First line of monitoring.
Eys-on-Glass monitoring.
Basic analysis, following
SOPs / playbooks
Actively look for loop
holes in network / system
/ configuration
Actively looking for threat
information and correlate
it with assets belong to
the organisation
Look deeper in to security
incidents. Assist in
investigating cyber
crimes
Remediate security
incidents ASAP based on
analysis performed by
security analyst
Actively dive-in to SIEM
data to look for
suspicipous activities
especially unknown
threat / zeroday
Configure, fine-
tune and maintain
SIEM solution
Second line of
monitoring.
Having more
experienced on
security analysis
Coordinate with all
team members.
Define and
document
process. Run the
operations

14. Solution: SOAR

15. SOAR
Next-Gen SOC utilise SOAR (Security Orchestration Automation and Response)
to perform actionable insights and interaction with another component in the
network

16. Use Case: Vulnerability
Management System
Define vision for the
team. Evaluate budgetary
/ resource concerns
First line of monitoring.
Eys-on-Glass monitoring.
Basic analysis, following
SOPs / playbooks
Actively look for loop
holes in network / system
/ configuration
Actively looking for threat
information and correlate
it with assets belong to
the organisation
Look deeper in to security
incidents. Assist in
investigating cyber
crimes
Remediate security
incidents ASAP based on
analysis performed by
security analyst
Actively dive-in to SIEM
data to look for
suspicipous activities
especially unknown
threat / zeroday
Configure, fine-
tune and maintain
SIEM solution
Second line of
monitoring.
Having more
experienced on
security analysis
Coordinate with all
team members.
Define and
document
process. Run the
operations

17. Solution: Bigdata and AI
Next-Gen SOC pushes forward the
limits of a tri-dimensional
paradigm. It needs to increase the
detection surface and decision
velocity, decrease reaction time
by utilising bigdata analytics
combined with AI technology
“Potensi serangan DDoS terhadap website
IDNIC (Indonesia Network Information
Center) dengan URL
https://www.idnic.id (203.119.13.145) pada
tanggal 29 November 2018”.

18. Analytics in Next-Gen Security Operation
Center
Next-Gen SOC preventing breaches from happening,
by leveraging big data and supercomputing capabilities

19. Summary
• No, Next-Gen SOC doesn’t intend to replace Human with
Machine
• Rarity of Human in IT Security forces us to be more creative
within Industry 4.0 era
• People role “improved” i.e Trainer for the Machine, Analysing
only high classified unknown-complex threat, Data scientist, …
• Convert your facility from Traditional to Next-Gen need proper
plan: Map according to your organisation requirement, focus
on what is the most pain point, improve them with machine

20. END