With cyberattacks becoming sophisticated, keeping up with the growing rate of threats may seem impossible when your business lacks in-house security resources and staff. So, building a Security Operations Centre (SOC) is an ideal solution. But an obvious problem faced by organisations is the staffing crisis and skill shortage which puts massive responsibility on other members of the SOC team.
Security analysts spend hours troubleshooting the security monitoring sensors, repeating the process a few times, and adjusting the behavioural-based security solutions. Further, they are tasked with complex data collection to confirm or deny false positives. The entire process is tedious. To make matters more complicated, vulnerability could be announced and the team then scrambles for indicators and information.
Hence, there’s a high possibility of burnout as the employees try to keep up with their enterprise’s demands. Ponemon Institute claims that 70 per cent of SOC analysts accept being the victims of a quick burnout due to the high-pressure environment their job entails. Despite all the technology at a company’s disposal, they are burdened with tasks such as chasing multiple alerts, addressing the lack of IT visibility, and to top it all, they are required to be on call 24/7.
Tackling constant security alerts is challenging for SOC. It was found that 84 per cent of SOC analysts claim that the minimisation of false positives is the most expected task to be handled by them.
Also Read: MENA’s Startup Ecosystem: Heating Up, Gaining Ground
Enhance SOC Efficiency
Experts recommend CISOs focus on the measurement of the security tool, which should be capable of addressing the organisational pain points if the solution is built with purpose by a vendor expert who understands the nitty-gritty of the SOC. With the use of Security Event and Incident Management (SEIM), enterprises can adopt capabilities such as contextualisation and UEBA. It supports classifying users’ baseline behaviours and identifying abnormalities. SEIM also renders preliminary investigations to further detail the users, databases, and activities involved in an alert. These allow the team to identify the fake positives easily, which in turn reduces the team workload.
Meanwhile, some security vendors are reforming their SaaS and offering a Guided SaaS system. Experts suggest CISOs partner with such security vendors as they have expert incident responders and security analysts.
Also Read: On Data Governance, Stewards… and Dragons
Reduce Burnout
Sadly, SOC functions in a high-pressure environment. Here are some of the ways to decrease SOC burnout and increase efficiency.
- Specify the roles, procedures and processes within the SOC. Ensure all the members of the team hold defined positions, so they don’t overburden themselves.
- Set up responsibilities. Investigations and threat hunting should be the primary responsibilities, and using solutions can help in prioritising alerts. SEIM can help, too.
- Promote work-life balance. Consider appointing a managed security services provider (MSSP), if you operate a 24/7 SOC. It’s not possible to entirely remove human intelligence from cybersecurity, but wherever possible it can be supplemented with automation.
Be ready with an Incident Response Plan
Having an incident response plan can help employees and users identify the warning signs of a security event. Consequently, you can speed up threat detection by increasing the staff monitoring and controlling the network. Besides, having a backup plan handy can promote and streamline communications during an incident. It can keep your SOC up-to-date.
To improve the SOC effectiveness and efficiency, organisations need to practice the incident response plan. Conducting these plans regularly is a solution to look for inefficiencies or potential pitfalls.
Cysiv, which expanded its operations into the MEA region last year, now delivers SOC-as-a-service from its global network of SOCs, including its newest one in Cairo. Apart from its software development centre in Cairo, the company opened a sales office in Dubai and while expanding to other parts in the region.
It is critical that cybersecurity is an ongoing process as part of a business function, and SOC, which is essentially the correlation point for every event logged within the organisation that is being monitored should be prepared for any eventuality, including detecting and responding to incidents.
