From SIEM to SOC: Crossing the Cybersecurity Chasm
2 likes2,045 views
You own a SIEM, but to be secure, you need a Security Operations Center! How do you cross the chasm? Do you hire staff or outsource? And what skills are needed? Mike Ostrowski, a cybersecurity industry veteran, will review common pitfalls experienced through the journey from SIEM to SOC, the pros and cons of an all in-house SOC vs. outsourcing, and the benefits of a hybrid SOC model. Learning Objectives: 1: You own a SIEM, but to be secure, you need a SOC. How do you cross the chasm? 2: What are the pros and cons of in-house, fully managed and hybrid security? 3: What considerations go into deciding whether to employ a hybrid strategy? (Source: RSA Conference USA 2018)
Ad
More Related Content
What's hot (20)
Similar to From SIEM to SOC: Crossing the Cybersecurity Chasm (20)
Ad
More from Priyanka Aash (20)
Ad
Recently uploaded (20)
From SIEM to SOC: Crossing the Cybersecurity Chasm
- 1. SESSION ID: #RSAC Mike Ostrowski FROM SIEM TO SOC: CROSSING THE CYBERSECURITY CHASM TECH-F02 VP Proficio @proficioinc
- 2. #RSAC 2 • Managed Detection and Response Service Provider • Three Global Security Operations Centers • Both Cloud Based SIEM / SOC and Hybrid SIEM / SOC • Operate over 18 SIEM platforms in our SOCs • Co-Manage many SIEM platforms for Clients plus SOC-as-a-Service • Experience with SIEM, SOC, Threat Intel, Incident Response, UBA, and AI EXPERIENCE FROM THE CHASM
- 3. #RSAC 3 • SIEM Foundation • SIEM Optimization • SOC People, Process, and Technology • SOC Metrics • SOC Total Cost of Ownership Comparison • Apply Lessons Learned HIGHLIGHTS WE WILL COVER
- 4. #RSAC SIEM FOUNDATION 5 • Define your Log Sources • Perform Asset & Policy Business Context Modeling • Define Incident Definitions, Categorization, & Response Actions • Define Use Cases to Detect, Validate & Respond • Detect Indicators of Attack, Indicators of Compromise, or Policy Violations • What log or data sources are useful • How will suspicious Indicators be validated, investigated, and enriched for triage and response escalation actions • Create SOC Workflow to enrich data for Analyst review, process for validation & triage • Create Run Book for escalation and incident lifecycle management
- 5. #RSAC 6 USE CASES MAPPED TO KILL CHAIN • Cyber Kill Chain is an excellent map for Use Case development • ‘Zero Trust’ Model required visibility across the entire chain and enterprise • Early threat discovery and rapid containment are critical
- 6. #RSAC SIEM OPTIMIZATION 7 • Enable Automated Alerts that are ticketed to Incident Responders & Operations teams • Create ability to assign Analyst Action Required alert investigations by SOC Analysts • Create SOC workflow to ENRICH DATA FOR HUMAN VALIDATION AND TRIAGE • Detect: Validation / Investigation / Triage / Escalation – Ticketing • Respond: Containment / Incident root cause investigation / Incident Scope investigation • Remediate: Lifecycle management / Change or Add Control, Detection, or Compensation
- 7. #RSAC CREATE SOC WORKFLOW IN YOUR SIEM 8
- 8. #RSAC 9 SAMPLE ESCALATION Security Team Triage and Ticket to Network Team Triage and Ticket to Desktop Team Use Case Auto-Assign Incident Criticality Based on Asset Model and Incident Classification Auto Generate Incident Response Classifications Based on Use Case SOC Analyst Analysis of Event and Research Source Data Enrichment for SOC Analyst and Responders SOC Analyst Manual Response Recommendation
- 9. #RSAC WHAT THE SIEM VENDORS DON’T SAY? 10 SIEM is Just a Tool People are Required Without Airtight Processes, it Won’t be Effective
- 10. #RSAC 11 Infrastructure Management • SIEM • Log Collection • Log Storage Content Author • creates & tunes Use Cases continuously SOC Analyst Tier 1 • monitors, validates, investigates, & triages Security Engineer • advanced analysis, response, post incident investigation & remediation SOC STAFFING Threat Hunter • looks for the unknown and stays current w/ emerging threats Threat Intelligence Manager • stays current with fast moving emerging threats Incident Responder • Containment / IR root cause investigate / scope investigate Manager • manages the teams and KPI metrics
- 11. #RSAC SOC BY THE NUMBERS 12 Sample Metrics for 100M Log Events per day • 1,000 Alerts or Notables without tuning Use Cases for SOC Analyst to Investigate • Goal is <2-3 Actionable Alerts with context, triage, and IR guidance • Without Excellent SOC Workflow: Average SOC Analyst performs 10-15 Investigations day • Requires 4 SOC Analysts per 24 hours or 8 SOC Analysts for 24x7x365 • With optimized SIEM and SOC: Average SOC Analyst performs 25-30 Investigations per day
- 12. #RSAC FORRESTER TEI REPORT 13 Total Economic Impact Study on ROI of SOC-as-a-Service Key Quantifiable Benefits include: • Avoided cost of staffing to achieve the same services valued at $845,530 • Improved staff productivity valued at $182,907 • Avoided cost of retired security tools valued at $179,856 • Incremental projects provided by existing in-house team valued at $70,999 • Reduced cost of minor security breaches totaling $111,908
- 13. #RSAC ADVANCEMENTS IN SIEM/SOC AUTOMATION 14 Extending Discovery • UEBA – Use Cases • Application Aware - both cloud and on premise Machine Enhanced Human Decision Making • Machine Learning • Artificial Intelligence Incident Response Orchestration • Automated Containment • Guided Playbook Business Intelligence of Security for the Boardroom
- 14. #RSAC 15 1. List Your Goals • MTTD, MTTC, MTTR, and Visibility Mapping of Your Environment • How will Map to your Cybersecurity Framework (NIST Identify, Protect, Detect, Respond, Recover) HOW TO APPLY THESE LESSONS 2. Build a Scope & Resource Model for SIEM and SOC • What logs will you collect, this will drive your resource model requirements • Define critical Use Cases • Engage stakeholders and executive management 3. Build a Total Cost of Ownership Comparison Model • This will drive budget and in-house or outsource decisions 4. Define KPI’s and What is Presented to the Board • What are your Security Program Key Performance Indicators Preparation
- 15. #RSAC 16 Crossing the Chasm • Enable business context modeling in Use Cases for Situational Awareness and Response • Enable 5 to 10 use cases per log source and operational area – focus on kill chain discovery • Integrate threat intelligence with use cases • Enable SOC workflow application with full life cycle of an event management • Enable Automated and Orchestrated Incident Response • Measure and manage by KPI’s HOW TO APPLY THESE LESSONS
- 16. SESSION ID: #RSAC THANK YOU! FROM SIEM TO SOC: CROSSING THE CYBERSECURITY CHASM TECH-F02 Mike Ostrowski | VP | Proficio [email protected]