SIEM And NDR: Better Together

Executive Summary

Security operations grows more difficult on an annual basis as cyber-adversaries collaborate and improve their attacks to circumvent security controls and analytics systems. Meanwhile, the attack surface keeps expanding as CIOs move workloads to public clouds while business managers embrace SaaS applications and new types of devices for digital transformation. Somehow, the security operations center (SOC) team is responsible for monitoring all these systems and network connections to prevent, detect, investigate and respond to security incidents.

Unfortunately, many organizations simply can’t keep up with the growing scale and scope of security operations, increasing cyber-risk and the potential for a devastating cyber-attack or data breach. Why have things gotten so difficult and what can be done to address this situation? This report concludes:

Security operations is fraught with many challenges. Many security operations centers were built using disconnected point tools and manual processes. This design may have worked in the past, but it is no match for today’s environment, which requires speed and efficiency. As a result, security teams are buried by security alerts and spend much of their time dealing with one emergency or another.

Organizations are modernizing their SOCs. The term “SOC modernization” has gained popularity within the cybersecurity professional community. SOC modernization includes things like technology integration, process automation, advanced analytics, and threat intelligence contextualization and enrichment within all other security operations technologies. The goal? Create an interoperable security operations and analytics platform architecture (SOAPA) that can help the SOC team bolster security efficacy and operational efficiency.

SIEM systems should be integrated with NDR. SIEMs anchor their analytics to event and log data while NDR monitors network flows, packets, and metadata. Many organizations use both systems independently when they really have a common purpose—timely and accurate threat detection and incident response. By combining these two systems, organizations can benefit from higher fidelity, detailed, and actionable alerts. This can lead to improvements in mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR) to threats.

SOC Modernization

Enterprise CISOs recognize that their security operations are falling behind and are addressing this growing gap by implementing a technology foundation for SOC modernization. This effort includes:

Creating a security operations and analytics platform architecture (SOAPA). A lot of the overhead associated with security operations is directly related to the SOC team’s reliance on dozens of disconnected point tools. Each tool needs to be configured, deployed, and operated, while the SOC team pieces together enterprise security status on a tool-by-tool basis. To address this inefficient model, CISOs are pushing their teams to merge tools into an interoperable SOC technology architecture (SOAPA). According to ESG research, 36% of organizations consider SOAPA development critical and a high priority, while another 48% consider SOAPA development an important initiative (see Figure 2).

Automating processes. Many SOCs are automating processes in several ways. First, they are automating pedestrian tasks, like matching a user identity with an IP address, that are performed multiple times per day. This alone can help SOC teams bolster productivity and throughput. Beyond this, leading SOCs are automating processes for more advanced use cases like threat hunting investigations or SSL certificate management. This not only helps to scale the SOC staff but also allows analysts to move beyond firefighting and adopt a more proactive security strategy.

Implementing advanced security analytics. To address the volume of security alerts, SOC managers are employing new types of analytics solutions that can process and analyze massive amounts of data in real time. The goal? Reduce the noise in the system while producing high-fidelity, detailed, and actionable alerts. This can also help SOC teams reduce today’s chaos by focusing the right resources on high-priority business-critical security tasks.

Injecting threat intelligence into everything. When suspicious behavior triggers an alert, security analysts need to know whether it’s a random event or tied to known cyber-adversary tactics, techniques, and procedures (TTPs). This means that SOC teams need to process and analyze threat intelligence at scale, enrich security alerts with threat intelligence details, and integrate threat intelligence with security controls to immediately block malicious domains, files, IP addresses, emails, etc. Operationalizing threat intelligence in this way acts as a backbone for a modern SOC.

Establishing a common workbench for security operations. Rather than pivot from UI to UI, modern SOCs consolidate the input from multiple tools into common dashboards, graphics, and reports that can be customized for different roles, skill sets, and needs. The best workbenches will support SOC team needs for cyber-risk management as well as across threat prevention, detection, and response.

Figure 2. Organizations are Integrating SOC Tools

In general, what would you say are your organization’s biggest persistent storage-related challenges in terms of its container-based environment? (Percent of respondents, N=274, multiple responses accepted)