Three journeys to SOC success: Part One

AUGUST 24, 2021

DAVE MAREELS

IT leaders in mid-sized organisations have plenty to keep them awake at night. How to continue to drive the digital transformation accelerated by the global pandemic? How to ensure security in our new remote work model? How to cultivate collaboration and resilience in an uncertain landscape?

SecOps (Security Operations) is often found near the top of the list for these IT leaders – in particular, how should we manage the huge volume of alerts generated by our modern security tool stack?

This is where SOC.OS can drive real value.

What’s the challenge facing security teams?
A medium-sized business is likely to be running multiple security solutions; everything from perimeter defences (e.g. next-gen firewalls), to email security software, to endpoint and network protection (e.g. EDR/NDR). The organisation may feel confident that it’s stopping more threats this way. Perhaps they also now meet the terms of their cyber insurance, satisfy canstakeholders that their interests or assets will be protected or achieve an important step on their cyber maturity journey.

There’s an unintended consequence: the large number of alerts generated from such tools can complicate threat detection and response efforts. Recent research has shown that the average time to detect and contain a breach is 280 days.

The bottom line is that SecOps teams, often only one or two people-strong, are drowning in alerts. The result? Little or no visibility of the threat exposure on their network.

What are the options to help security teams overcome alert overload?
SIEM platforms can help by aggregating logs across multiple security tools to generate real-time alerts for malicious and anomalous activity. However, they’re extremely time and resource-intensive for smaller firms; not just in deployment, but also due to the ongoing management needed to continually fine-tune the technology, and keep up with emerging threats.

Set up a one-vendor security tool stack. Rather than the work of translating the different outputs of security tools into a common language, swivel chairing from console to console to get a view of your estate and having to normalise severity scoring to inform investigations, having a single vendor tech stack can keep things simple.

Dependant on your needs, toolset and internal capability these solutions might not suit small teams. Transforming your security tech stack to a single vendor requires a lot of resources, as does maintaining a SIEM or SOAR solution.

Moreover, organisations might be happy with the current alert generation capabilities of their individual security products. All they need is better integration and prioritisation.
 

How can SOC.OS help?
SOC.OS captures alerts from all the security tools running in an organisation, both on-premise and in the cloud. It then enriches these with business context and third-party threat intelligence, and correlates them into related groups (clusters), before finally ranking them in order of priority. SOC.OS customers have already seen a reduction in the amount of time they spend triaging alerts by 4x.

SOC.OS can be up and running in under a day. It will immediately start adding value by visualising real-time alerts & clusters, and then flagging the most urgent 

About the author

BACK TO BLOG

For more information about SOC.OS, contact info@socos.io