DtSR Episode 578 - Maybe A Modern Day SOC Discussion
Nov 21, 2023
auto_awesome
Experts Jim Tiller and Anton Chuvakin discuss the evolution and challenges of Security Operations Centers (SOC), including the impact of global macroeconomics on security technology, the importance of collaboration between different teams, and the shift towards automation. They also explore false positives and negatives in the modern SOC environment, and the challenges of outsourcing security operations.
The evolution of SOCs into modern-day hybrids focuses on collaboration between internal and external functions.
Balancing bespoke security solutions with outsourced services is crucial for effective risk management.
Transitioning towards a hybrid SOC model, combining automation and human expertise, enhances security efficiency and threat detection.
Deep dives
Evolution of Security Operations
Over the past decade, there has been a significant shift in the role and importance of Security Operations Centers (SOCs). Salespeople used to easily sell security solutions, but now SOCs play a critical role in technology. The labor market and global macroeconomics also impact the evolution of SOCs.
Modern SOC Functionality
Modern SOCs are a blend of internal and external functions. While managed service providers (MSPs) handle machine-based detections, internal SOCs serve as IT help desks, dealing with a variety of issues like password resets and VPN troubleshooting. The internal SOC's role is split between human-generated events and machine-based detections.
Challenges in SOC Management
The discussion highlights challenges faced by organizations in managing SOCs effectively. Factors such as false positives, false negatives, outsourcing complexities, and the need for shared tools between IT and security operations teams pose ongoing challenges. Finding the balance between innovation, collaboration, and the reliance on technology remains critical for SOC success.
Shift Towards Bespoke vs. Commodity Security Solutions
The podcast discusses the importance of focusing on building bespoke security solutions tailored to the company's specific needs rather than relying solely on commoditized security services that can be outsourced. By identifying internal risks and monitoring critical aspects internally, companies can allocate their resources effectively. This strategy differentiates between essential bespoke security measures and common outsourced services like endpoint protection, highlighting the need for a balanced approach in security strategy.
Evolution towards Hybrid SOC and Application Security
The conversation delves into the evolution of security operations centers (SOCs) from traditional models to hybrid approaches emphasizing collaboration between outsourced and in-house capabilities. The dialogue touches on the shift from infrastructure-focused detection to application security, recognizing the importance of detecting threats across various attack surfaces. The speakers explore deploying tailored detections for internal products and monitoring governance rules within the realm of modern security operations, anticipating a move towards a hybrid SOC model that combines commodity automation and human expertise for a more efficient security posture.
TL;DR: I finally decided that Erik Bloch's LinkedIn posts have provoked a certain interest in a conversation about what a "modern-day" SOC should look and behave like. I then invited Jim Tiller and Anton Chuvakin (because they have some opinions), on the show to join James and me to discuss this. It didn't quite go to plan.