Security Operation Center (SOC)

I have previously written on SIEM before, which is a main part of a SOC. Todays’ post dive in to details of a SOC which makes use of a SIEM system. To get clarified the relationship between the two, let’s get in to the business without any further ado.

What is a SOC?

Image Source: https://cybrhawk.com/security-operations-center/

SOC stands for Security Operation Center, which is a centralized unit that deals with security on an organizational level. This centralized unit includes people, processes and technologies in continually monitoring organizations’ security posture. SOC has its objectives as preventing, analyzing, and responding to cybersecurity incidents.
SOC brings the organizations’ IT security monitoring and incident response activities in to a single location and hold the responsibility of handling internal breaches and cyber-attacks.

The Importance of Having a SOC

Organizations, regardless of their size is always subjected to cyberattacks, malware infections and data breaches which lead to the hindrances for ensuring the three most important aspects of information security (CIA) :

• Confidentiality
• Integrity
• Availability

With the rapid development of cyber attacks in this information driven era, organizations are focusing more on solving these security issues, providing rapid solutions by setting up a SOC, either by the organization itself or through a security services provider.

How Does a SOC Operate?

A SOC acts as a central command post with the aid of a combination of technology solutions and a strong set of processes. Typically, a SOC is comprised of a skillful team led by a SOC manager. The team may comprise of incident responders, security analysts, engineers and incident response manager(s) to provide ongoing, operational enterprise wide information security. SOC takes in telemetry from networks, servers, endpoints, databases, applications, websites, and other systems. When an attack takes place, SOC incident response team perform advance forensic analysis, carry out malware reverse engineering, cryptanalysis and sometimes collect forensic evidence and analyze in a legally sound manner.
As the first step in establishing an organizations’ SOC, the strategy needs to be clearly defined. This strategy needs to be aligned with organizations’ business goals. The second step is to set up the infrastructure supporting the strategy. A typical SOC infrastructure includes firewalls, IPS/IDS, breach detection solutions, probes, and a security information and event management (SIEM) system. SIEM aggregates and correlates data from security feeds.

SOC is built adopting the hub-and-spoke architecture. Hub of the model is the SIEM while Spokes of this model can incorporate a variety of systems, such as vulnerability assessment solutions, governance, risk and compliance (GRC) systems, application and database scanners, intrusion prevention systems (IPS), user and entity behavior analytics (UEBA), endpoint detection and remediation (EDR), and threat intelligence platforms (TIP).

Responsibilities of a SOC Team

Taking Stock of Available Resources

The SOC is responsible of safeguarding assets such as devices, processes and applications. In order to do that it is vital to keep track of all the assets that need to be secured. Ensuring visibility and control from device to the cloud SOC’s goal is to gain a complete view of the business’ threat landscape, including not only the various types of endpoints, servers and software on premises, but also third-party services and traffic flowing between these assets.

Implement and Manage Security Tools

As mentioned above, the SOC makes use of tools to gain the insights in to the organizations’ security environment. The selection of appropriate tools considering the system integration requirements, develop solution trials and demos, and assess interoperability with current infrastructure is expected to be performed by the skillful staff of the SOC.

Preparation, Investigation, Containment and Prevention of Incidents

It is vital for the SOC team members to be on the know of newest security innovations and the latest trends in cybercrimes. Creation of security roadmap and a disaster recovery plan is of utmost importance.

With the insights taken from SIEM system, the SOC team looks into suspicious activity within IT systems and networks. The SOC should correlate and validate alerts. SOC staff can contextualize these events within the network environment of the business, and coordinate response activities with key staff in real time.

Reduce Downtime and Ensure Business Continuity

Even though the most desired state of no interruptions of downtimes is far from being possible, organizations need to operate under minimal or no downtime to carry out business processes smoothly and intact. In an instance of a breach, it is mandatory for the SOC to inform the stakeholders of the event proactively, while acting to keep critical infrastructure from the security events. SOC has to make sure that the redundancy is in place to guarantee the business continuity.

Security Strategy

The security strategy should be in line with the business strategies, including all the departments like IT, IR, HR, legal, compliance and other groups.

Alert Ranking and Management

The number of false alerts is about 80% of the total alerts reported. Since the SOC is operating on tool issued alerts, it is mandatory to keep close eye on those and discard the false positives. It is the job of SOC staff to determine how sever the actual threats are and what their true targets.
Prioritizing the threats, so that the most urgent ones are handled first, is a crucial task expected to be performed by SOC.

Threat Response

It is the responsibility of specialized team in SOC to figure out what actions to be taken in an event of a security breach, which will have minimal impact on the business continuity.

Recovery and Remediation

SOC works to restore the systems and recover any lost data once an incident has taken place. Upon the success of this remediable steps, the network will return to the state it was in prior to the incident.

Apart from above, SOC is responsible for root cause investigation, security refinement and improvement and compliance management.

References

https://www.mcafee.com/enterprise/en-us/security-awareness/operations/what-is-soc.html
https://www.mcafee.com/enterprise/en-us/security-awareness/operations/building-a-soc.html
https://digitalguardian.com/blog/what-security-operations-center-soc
https://resources.infosecinstitute.com/topic/security-operations-center/
https://www.exabeam.com/security-operations-center/security-operations-center-roles-and-responsibilities/