Understanding SOC Essentials for your Business 

The aim is to focus on threat hunting and detection, avoiding the need for incident response and remediation, a time when something has already gone wrong, explained Deryck Mitchelson, EMEA CISO at Check Point Software. He added that there is a growing focus on improving general cyber hygiene so that organisations encounter far fewer issues.

“This means they’re getting much less in the way of false positives,” he noted.

Mitchelson also pointed to the changing nature of work, with many organisations now pursuing a hybrid working model.

“There’s so much data coming through that your standard analyst teams can’t cope with it,” he said. “They’re having to rely a lot more on machine learning and AI. There’s a lot of hype around that but it’s still relevant to making better decisions.”

SOCs will, over time, use this automated capacity not just to detect but to remediate threats, Mitchelson believes.

“We’re starting to see a lot more of that in the cloud with auto-remediation of misconfigurations or issues,” he explained. “The threat surface is so large now that you can just keep adding bodies to the SOC. We’re at the stage where bodies are not the answer, it really is to do with automation, efficiencies and simplification.”

This does not mean that traditional skills are going away, he said. Analysts will still be needed, particularly when it comes to complex queries. However, AI could help them avoid becoming bogged down in phishing or other email-related problems; these often take up 20% of the time of many SOCs Mitchelson works with.

“That creates a huge amount of work for a security operations team,” he said. “You need to try and simplify these things.”

While the size of a SOC team and the way the service is delivered depends on the organisation concerned, “the main driver is to very simply detect malicious behaviours in the organisation’s environment,” commented Chris Meenan, vice president of product management for IBM security. For all organisations, ransomware continues to be a highly prevalent actor vector.

“That’s because [ransomware is] just so effective and so many organisations aren’t fully protected against those types of attacks,” he said. “Their data is overly exposed, they don’t do back-ups regularly, they don’t have their endpoints properly protected.”

He also pointed to the expanding use of Cloud services, which has driven an increased attack surface for threat actors to target. “That expanding attack surface is really starting to change the way SOCs think about their priorities and their tooling and their processes.”

This has led to a growing focus on attack surface management (ASM) he said, which can provide key insights into the attacker’s perspective.

“At the minute, security teams don't often know what the attackers are looking at, or even what cloud services they're using, what cloud infrastructure they're using. Understanding that attack surface, how the attacker is looking at their infrastructure is really important,” Meenan said.

As the user experience increases in its complexity and diversity, so the workflows must become more unified and streamlined to help them cope. “That user experience and analyst workflow is an area that we think is going to evolve quite dramatically over the next few years with a real focus on simplicity, automation, and AI to help analysts see what's most important for them to take action on and help them take action in a very confident way.”

Finally, Meenan said he anticipates a greater reliance on security being delivered from the Cloud, using open standards and APIs to integrate systems. “We will see that evolve much more…it will all be made available from the click of a button in the cloud.”