When it comes to SOCs, few people realize that a Security Operation Centre can also be managed as-a-Service. A SOC acts as the central hub or command post, acquiring telemetry data from an organization’s IT infrastructure, including its networks, devices, appliances and information repositories, wherever they reside as resources. In essence, it is the correlation point for each event recorded within the organization that is being monitored and, for each of these events, the SOC must decide how to act. As a consequence of the extreme versatility to which the cloud world has accustomed us, the SOC as a service, i.e. SOCaaS, works to outsource some of the functions of a security center to an external provider.
The switch to the cloud creates a scenario in which security information, including alerts, telemetry, logs and network information, becomes accessible from virtually anywhere, as opposed to local analysis. Why SOCaaS One of the main reasons why a company should adopt a SOCaaS model is that security threats hit targets that are least prepared to recognize them in advance. This requires real investment in hardware, technology and people. A team that is ‘always on the ball’ must constantly learn about new variants of intrusion, while communicating with other specific job roles, analysts and technicians. For this reason, a Security Operation Centre as-a-Service can respond to increased security needs without having to build in-house staff dedicated to this landscape. On balance, if budget is not an issue and you have enough staff to set up and maintain a SOC, 24/7, then it may make sense to go the traditional, home-grown route.
If, on the other hand, there are greater constraints, in terms of money and resources, then SOCaaS may be the better approach. One of the most advanced SOCaaS technologies around provides a complete service for enterprise security, ranging from data collection and enrichment (SDL) to event and information management (SIEM) and user behavior analysis (UEBA). SOC as-a-Service is focused on an environment permeated with artificial intelligence, which continuously analyses log-files to identify threats and mitigate risks.
Always protected
The advantage of having a technician on hand 24/7 allows potential threats to be verified and action to be taken to nip attacks in the bud. The SOAR (Security Orchestration, Automation and Response) process starts with the collection of logs, then proceeds to SIEM, anomaly detection, manual control, identification of the possible problem and notification to the customer.
These are supplemented by the staff of ethical hackers who constantly check data that could identify a cyber threat, intervening if necessary to stop the breach. Defending against persistent threats We know how zero-day threats constantly endanger companies of all types and sizes. Can SOCaaS also intervene to minimize this risk? The answer is yes, since every type of data produced by the interconnected systems in the infrastructure is collected, normalized and analyzed, to check not only for the presence of known indicators of compromise (IOC), but also for suspicious operations and behavior; attack attempts that are normally very difficult to detect, such as those involving zero-day. Also, worth mentioning within SOCaaS are the machine-learning and context-aware detection capabilities that enable security analysts to deal with the most sophisticated attacks. With long-term search, organizations can reduce the time needed to investigate and find threats that are already in their environment. With long-term search, you have the ability to proactively search historical data, through a scalable search that does not impact SIEM performance.
Searching into deep…
It is not uncommon for corporate data to be stolen and used to plan a heist, such as ransomware. This information is often shared in those areas of the web called the Deep Web and Dark Web. Thanks to a Cyber Threat Hunter, the SoCaaS platform is able to search and retrieve that information. For this, an important add-on can be Cyber Threat Intelligence, carried out by a Cyber Threat Hunter, which exploits indicators of compromise and other possible evidence of the presence of a threat in a system. The result is virtually immediate mitigation of identified threats, with a net reduction in unplanned downtime and potential losses for each attack detected over time. CTI is the final process in a cycle that includes data collection, processing and analysis. New questions and gaps are identified during intelligence development, leading to the definition of new collection requirements. It ranges from planning and direction to collection, processing, analysis, distribution, and feedback, at the end of which, the person who made the initial request determines whether their questions have been answered and, if so, proceeds to resolve the problem or secure part or all of the network.
