Security

Your Security Stack Is Working. Are your Security Operations?

Technology provides critical support for security teams and processes — not the other way around.

Joel is an internationally recognized expert in the areas of security, networking and messaging. Follow him on X (formerly Twitter) @joelsnyder.

Walk into a modern enterprise security operations center today, and you'll discover just how inexpensive 65-inch monitors are: The walls are covered with them showing dashboards from security information and event management (SIEM) consoles, extended detection and response (XDR) endpoint security platforms, firewall intrusion prevention systems (IPS) and data loss protection (DLP) software. It's all very impressive and mission-control.

Yet breaches still occur. And after the worst of them, the postmortem is almost always a variation of the same story. Yes, the alert was received. The log clearly showed the problem. The vulnerability was advertised and known. But the organization still failed to respond in time, the ransomware proliferated, the data was exfiltrated and the hackers were able to move around the network without being stopped.

Click the banner below to learn why detection and response is the new security baseline.

The security industry makes it easy to buy products. There's always a new acronym or next generation or amazing AI-powered breakthrough. But products only generate signal; they keep those snazzy monitors flashing. It's the people and processes in a SOC that convert that signal into actionable intelligence and threat mitigation.

If your threat hunters are falling behind, you more likely need to invest in your operational framework than to buy a new license.

GO DEEPER: Discover how to find your biggest security gaps without adding more tools.

Why Staffing, Processes and Incident Response Matter Most

Cybersecurity technology delivers amazing amounts of raw data to SOC teams. That technology must be matched with both maturity and flexibility on the human side.

For example, a SIEM alert about a Microsoft PowerShell script running on an Active Directory domain controller could be the first sign of a major problem, or it could be nothing out of the ordinary.

To differentiate, the SIEM has to provide context, and context has to come from the organization itself. What's the identity running the script? Is there a change ticket, even an unapproved one, for this server? Are there other alerts for this identity or this server in the same time frame? Is this a critical system, or is it a lab server someone is practicing on for their next certification?

The alert needs to be turned into an incident, with all supporting information and context, before it’s handed over to an analyst. Without these steps, the analyst can’t make decisions — and must gather that information anyway, manually, in a time-consuming and ad-hoc way.

How to Manage Alerts to Get Real Value

How Mature is Your Security Posture?

It’s easy to think that more technology is the solution, but that’s the wrong way to think about the problem. The way out is augmenting your existing technology enough that the human side can jump on things and solve the problem quickly. If teams are siloed by technology or responsibility, if the workflow of an incident is informal instant messages, if the incident can’t be handled until the right person comes on shift with the right institutional memory, then mean time to respond (MTTR) suffers. IT teams might have the capability to solve the problem, but not the capacity to do it in the time frame that matters.

There’s a quote you hear often when security professionals talk about their alert load: If everything is urgent, then nothing is urgent. Solving the problem of too much noise is critical to the effectiveness of any organization's security team.

Responding to threats also requires a continuing human feedback loop back to the technology. SIEMs and XDRs will generate noise, and that noise gets louder as the world gets nastier. IT teams must feed back into security tools to refine correlation rules, update context information, improve filtering of what they see and update processes based on lessons learned.

All that takes time and will never be fully automated. That final feedback loop to improve the signal-to-noise ratio requires a commitment by IT management, allocating the right people with the right capabilities the additional time they need to provide a cycle of continuous improvement.

Click the banner below to learn how to start building security confidence.

Passing the Test: Is SecOps Operationally Ready?

At its simplest, security operations is a four-step cycle: collect logs, enrich incidents, standardize response and — post-incident — provide feedback to improve tools and processes. Technology makes it possible but in a supporting role; people and processes drive everything.

IT managers can self-audit to see if they’re balancing technology investment with proper processes and human resources. Is the MTTR for incidents measured in minutes and hours, or days and weeks? Are high-priority alerts enriched enough that an analyst’s first step is deciding how to remediate, or do they waste time cross-referencing logs and configuration databases? Is the workflow for most common problems in a playbook, standardized and tested, or does the response vary based on who’s sitting in front of the console? Are major incidents accompanied by a root-cause analysis that feeds back into tuning and informs the incident playbook?

Building a mature SOC requires a human context, meaning people and workflows that define how threats are identified, handled and resolved. Existing investments in security technology support these workflows. Doing this properly isn’t an overnight job. For example, automation starts with incident enrichment and context, pulling information from identity and access management systems, configuration databases with asset and data criticality, patch history, and internet sources such as known vulnerability lists. Once that’s solid, adding automated response and containment is a great next step.

Technology maturity must be matched with organizational maturity: Teams must be on the same page when it comes to isolating a compromised system or taking down a production server. The time to fight over this is before an incident happens, or in a postmortem review, but not when there's a live incident in progress.

With AI-enhanced attackers everywhere, speed of response is the most critical metric. When a threat can be mitigated by automation, it should be. Security technology provides visibility, but having people and processes in place provides velocity.

whyframestudio/Getty Images