The challenges of building a Security Operations Centre from scratch

Why Build a SOC?

• Conduct a risk assessment: identify your most valuable assets and understand the potential threats to them
• Consider impact of breaches: understand the challenges created from security breaches, consider time and cost to recover, damage to reputation and trust and even employee satisfaction.
• Review compliance and regulatory requirements: ensure compliance, document all the rules and regulations you must abide by and consider governance procedures.
• Be aware of the evolving threat landscape: leverage a dynamic and fully equipped SOC to respond rapidly to changing threats
• Allocate resources: consider financial investment, required skills, and technology
• Strategic alignment: ensure the SOC will be in support of broader business strategy and objectives

• Operating Model – discusses and align on the various factors that need to be considered when designing a SOC.
• Onboarding – provide guidance on how to determine what logs/information should or could be made available to a SOC and introduces the use of attack trees to help you intelligently make decisions about log sources.
• Detection – discusses the various approaches in detecting cyber attacks.
• Threat Intelligence – touching some of the common issues around threat intelligence and explore the value it adds to the SOC.
• Incident Response and Management – builds on existing guidance and discusses how it fits into the SOC as a whole. 

• Identification: Understanding what needs protection
• Protection: Implementing measures to guard against threats
• Detection: Monitoring and identifying security events
• Response: Addressing detected security incidents
• Recovery: Restoring systems and strengthening defences post-incident
• Governance: Ensuring compliance and overseeing security operations

• Develop a charter: document the mission, scope, and objectives explaining why the SOC exists
• Define the scope: determine what the SOC will/wont monitor, as well as the resources required
• Outline responsibilities and standard operating procedures: describe the primary responsibilities including monitoring events, managing incidents, compliance, vulnerability assessments etc.
• Authority to act: define what actions (if any) the SOC can make autonomously, when to escalate issues and how to interact with other departments
• User guidance: explain how users and employees interact with the SOC
• Support and endorsement from senior management: documented endorsement and ongoing support from senior management

• Assessing current capabilities: understanding the technologies and processes currently in place and how they can be integrated into SOC operations
• Technology and tools selection: deciding the right mix of technology and tools to enable the most efficient and streamlined monitoring, detection, and responses
• Staffing and training: plan for the recruitment of skilled personnel and their ongoing training to keep up with evolving cybersecurity threats
• Continuous improvement: establishing mechanisms for feedback and continuous improvement allows adaptation to the changing threat landscape and evolving business needs 

• Service catalogue development: this will detail each service, the tools and technologies required, the personnel responsible, and the processes involved in delivering those services.
• Core services:
  • Monitoring and triage: continuous surveillance of your networks to detect and assess security threats.
  • Incident response coordination: managing the response to security incidents, including the deployment of strategies to mitigate damage and coordinating internal and external stakeholders.
  • Security log management: collecting, normalising, and storing security event data to support effective analysis and incident investigation.
  • Threat and vulnerability intelligence: gathering and analysing information about emerging threats and potential vulnerabilities to keep you ahead of potential security issues.
• Advanced services:
  • Threat assessment: evaluating potential impact of detected threats and devising strategies to counteract them.
  • Vulnerability management: assess and address vulnerabilities to reduce the risk of exploitation.
  • Forensic analysis: conduct detailed investigations into how a breach happened, determine extent of instruction, and identify the perpetrators.
• Service alignment with business needs: services offered by the SOC must meet the needs and risk profile of your business. This alignment should be reviewed regularly to adapt to any changes in your business or threat landscape.
• Budget considerations: prioritise services based on risk assessments and the potential impact of threats and make your budget work as best it can.
• Customisation and scalability: services must be customised as per the evolving security requirements of your business. They should also be scalable to accommodate growth and changes in your structure or operations.
• Integration with existing infrastructure: your SOC should not operate in isolation. Ensure services are integrated with the existing IT and security infrastructure and practices to enhance overall security posture without duplicating efforts or resources.
• Implementation planning:
  • Resource allocation: assign adequate resources, including personnel and technologies, to each service.
  • Process development: establish clear processes for each service, detailing every step from initiation to completion.
  • Performance metrics: set up the KPIs for each service to measure effectiveness and facilitate continuous improvement.

• Identify your key metrics and common SOC KPIs
  • Average incident detection time: time taken from threat entering the network to when it is identified by the SOC.
  • Average incident response time: time taken for the SOC to react to a threat once identified.
  • Event and ticket queue backlog: number of tickets addressed within a predetermined time frame.
  • First call resolution: percentage of incidents resolved on first call.
  • First call escalation: measures how often calls require escalation past first point of contact.
  • Headcount to incident ratio: average number of incidents handled per SOC employee.
  • Headcount to ticket ratio: average number to tickets handled per SOC employee.
• Set targets: they should be realistic but challenging and push your SOC towards continuous improvement.
• Data collection and analysis: implement systems to automatically collect data relevant to KPIs - regular analysis of this data helps in tracking performance against set targets.
• Regular reviews and adjustments: review your KPIs to ensure they remain relevant.
• Reporting: deliver regular reports so all stakeholders are informed on the SOC’s performance

• Defining SOC roles: 
  • Tier 1 Analysts (Alert Analysts): Handle initial incident reports and data feeds.
  • Tier 2 Responders (Incident Responders): Provide a deeper analysis and response to escalated incidents.
  • Tier 3 Experts (Hunters or SMEs): Lead the response to complex incidents and proactively search for threats.
• Recruitment: finding individuals with a mix of technical skills, problem-solving abilities, and capacity to make smart decisions under pressure. Considering the current skills shortage, consider candidates with potential and invest in training and development.
• Training and development: continuous learning is essential in cybersecurity. Provide (or source) training sessions on threats, technologies, and countermeasures and encourage certifications and participation in industry conferences or workshops.
• Team integration and communication: ensure clear protocols for information sharing and collaboration between the tiers.
• Employee retention: implement policies that foster a positive work environment such as competitive salaries, benefits, and career development opportunities. Recognise and reward outstanding performances.
• Diversity and inclusion: diverse teams bring varied perspectives that can enhance problem-solving and innovation.

• Selecting technology platforms - choose the right mix of hardware and software. This may include:
  • Security Information and Event Management (SIEM) system: to aggregate, analyse, and alert on security data.
  • Intrusion Detection System (IDS)/Intrusion Prevention System (IPS): for monitoring network traffic to detect and prevent attacks.
  • Firewalls and Antivirus Tools: to block unauthorised access and detect malware.
  • Endpoint Detection and Response (EDR) Systems: For continuous monitoring and response to threats on endpoints.
• Data collection strategy - define what will be collected, from which sources, and how. Typical sources include:
  • Network devices: routers, switches, and firewalls
  • Servers and Endpoints: physical and virtual
  • Applications: especially those that handle sensitive or critical operations
  • Cloud services: including IaaS, PaaS and SaaS environments
• Data normalisation and storage: once collected, data must be normalised, which involves converting it into a common format that can be easily analysed. The data must also be stored securely and efficiently, with considerations for compliance with data protection regulations.
• Analysis tools and techniques: deploy advanced analytical tools to process large volumes of data and identify patterns that indicate potential security incidents. Machine learning and artificial intelligence are increasingly used in this capacity to enhance threat detection capabilities.
• Integration of systems: ensure all tools and systems are integrated for seamless data flow and sharing. Integration enhances visibility across the entire IT environment, making it easier to detect and respond to incidents promptly.
• Protocol establishment: define how data should be collected, how often, and at what detail level. This includes setting up the necessary configurations on data sources to ensure logs are detailed and useful but not so verbose as to overwhelm the SOC analysts.

• Budget constraints: it is hugely expensive to design and build the perfect SOC for your organisation, staff it, and equip it with all the tools you need to keep your business secure
• Expertise scarcity: there is a vast skills shortage for people of a sufficient skill level to run and maintain a SOC. Good talent is expensive to acquire, hard to retain, and is fraught with risk.
• Time Investment: as you can deduce from this guide, it's a hugely time-consuming effort that will draw key personnel away from business-as-usual tasks for extended periods.
• Alert fatigue and false positives: managing high volumes of alerts efficiently can drain time and energy from your teams. And if they are not sufficiently skilled, you can face all sorts of problems down the line.  

• Cost-effectiveness: reduces the need for in-house expertise and infrastructure.
• Expertise: provides access to top-tier security experts and advanced technologies.
• Scalability: easily scales with your business needs without additional investments.
• Focus: this allows your business to focus on core activities while security experts handle the defences.