Yaron Levi and Allan discuss SOC challenges, hypothesis-driven data analysis, business objectives, and the importance of context in threat detection. They highlight the need for structured approaches, threat modeling, and the value of trust in cybersecurity operations.
Starting with a hypothesis can revolutionize SOC management by proactively sifting data to mitigate cyber threats.
Context-rich data is crucial in alert management to prevent crucial threats from being overlooked or misinterpreted.
Deep dives
Building Robustness in the System to Handle Black Swan Events
It's crucial to build robustness into systems to mitigate the impact of black swan events, such as cyber attacks. By starting with a hypothesis and sifting data to support or disprove it, a radical departure from traditional SOC management can yield significant results. This approach emphasizes proactive measures and preparedness to address unforeseen challenges.
Challenges Faced in SOC Operations
The SOC confronts challenges like collecting excessive data, inadequate analyst training, and flawed analysis and hunting methods. The data overload leads to a poor signal-to-noise ratio. Analyst training is lacking, hindering effective response capabilities. Flawed methods rely on connecting alerts to form narratives, lacking clarity and effectiveness.
Contextual Relevance in Alert Handling and Analysis
Understanding alert context is essential to avoid dismissing critical alerts as false positives. Tools like UEBA and XDR, regardless of their capabilities, need proper contextual tuning. Alerts without context may lead to crucial threats being overlooked or misinterpreted, highlighting the importance of context-rich data.
Implementing Hypothesis-Driven Approach in Threat Detection
Adopting a hypothesis-driven approach in threat detection involves formulating and testing hypotheses to proactively detect potential adversarial activities. By simulating attack scenarios to support or disprove hypotheses, security teams can align their monitoring efforts with specific threats, fostering a more systematic and effective security posture.
Allan is joined by Yaron Levi, CISO at Dolby, to talk about the SOC and why we are going about it all wrong. Allan and Yaron identify and examine the three main areas of concern: the data, the analyst, the analysis – and how to improve upon them. Lastly, Yaron shares his thoughts on what steps and approaches need to be taken in order to successfully accomplish the SOC’s goal.
Key Takeaways:
01:35 Bio
02:36 What are we doing wrong in the SOC?
06:54 Hypothesizing
11:22 How much gets left out when we make a hypothesis?
13:42 Anti-fragility & business outcomes
16:30 Business objective + threat model example
21:09 Lead with the why/ downstream applications
27:06 What outside influence has helped you inside cyber?