- Today’s security operations center (SOC) is plagued with pests that prevent teams from supporting new initiatives and leave enterprises vulnerable.
- Teams must find ways to banish multiple monsters, from siren-like vendors all singing the same song to vampire solutions draining the life out of budgets.
- Security teams should work with vendors to address obstacles methodically so they can regain the agility for addressing shifting threats.
For many organizations, the security operations center (SOC) has become a haunted house. There are creatures that tempt security teams into perpetually evaluating new vendors, those that drain the life out of budgets, and others that demand near-instantaneous incident reports.
All these unwanted guests drag down security programs. They keep SOCs locked into time-consuming loops that prevent them from supporting new business and technology initiatives.
Precisely what monsters are lurking in today’s SOC? And how can both security teams and security vendors help banish them?
Sea-of-Sameness Sirens
Thousands of vendors sing the same songs. Security leaders can’t easily distinguish capabilities from one vendor to the next. They hesitate in making decisions and get stuck in evaluation purgatory.
Banishing these siren-like vendors requires a little discipline. Instead of endlessly exploring features, teams should build a one-page decision brief that maps each contender to a business risk. The differentiation should be clear to every stakeholder, including tech experts, executives, and business managers.
Vendors can help. They should focus on business benefits first, and back up claims with third-party validation.
Budget Vampires
Many SOCs are plagued with vampire solutions eager to drain the life from budgets. Some vampires are legacy systems that seem to live forever. Others are new solutions that teams do not recognize as a budgetary threat until those solutions are invited into the enterprise environment.
Instead of garlic, teams can rid themselves of vampires by analyzing ROI. Does that solution deliver measurable reductions in downtime, breaches, or compliance fines? Vendors can make that analysis easier, demonstrating how their solutions can reduce exposure to risks and safeguard sensitive information.
As soon as teams install solutions, they should start identifying wins where these solutions show their value. Teams can frame these solutions as worthwhile investments that deliver tangible results, not just necessary evils.
24-Hour Banshees
The banshees are the ones screaming when regulators demand incident reports in hours, not weeks. Those screams are growing in volume as new global laws and regulations demand rapid disclosures.
Security leaders, meanwhile, have trouble quieting those screams. They have to manage cross-functional workflows with legal and business teams, and their manual efforts just can’t deliver fast enough.
Quieting the banshees requires automation. Security teams should pre-build runbooks so they can gather facts, execute decisions, and assemble documentation as quickly as regulators require.
Disclosure Poltergeists
Just when teams think they have their house in order and are ready to show it to investors, disclosure poltergeists move the furniture—or maybe steal it outright. Organizations must disclose any material cybersecurity events (whether caused by poltergeists or human attackers) within four business days. That’s not much time to act.
It might not be possible to stop all attacks. So, teams should have plans in place to evaluate materiality and quickly determine whether to make disclosures. Running tabletop exercises can help legal and leadership teams define thresholds for materiality and establish efficient processes for decision-making.
Zero Trust Zombies
Zero Trust zombies are projects that begin as promises on a slide deck. But ultimately, they operate in a liminal state—not quite dead, but definitely not alive either.
Zero Trust projects can fail for numerous reasons. Some organizations might believe that they can implement a single Zero Trust solution and be done. In truth, these are multi-faceted projects that can require endurance across the organization.
To turn Zero Trust zombies back into active, living projects, teams should focus first on identity. They might begin with implementing multi-factor authentication (MFA), for example, and start enforcing consistent policies for the entire enterprise. At the same time, they should work to ensure sustained executive participation: Without it, the zombies will return.
Shadow Skills Ghosts
When teams need to patch legacy systems, they might find only ghosts of employees who have long left the company, taking with them irreplaceable skills. Finding workers with cutting-edge skills is just as likely to yield vapor. There is a persistent cybersecurity talent shortage that stretches from the data center to the C-suite, and it’s leaving organizations vulnerable.
Replacing ghosts with skilled employees requires more than aggressive hiring. Organizations must design career paths that help individuals work their way up to leadership roles over time. In parallel, they should prioritize solutions with automated capabilities to offset staffing challenges.
The MSP Tool Hydra
Cut off one tool, three more appear. Many managed service providers (MSPs) continuously offer new security tools in response to customer demand. But those new tools might overlap with existing ones or create inadvertent gaps.
To help security teams banish this hydra, MSPs should provide plain-English stack diagrams that define what each tool protects and highlight what remains unaddressed. Tying each tool to a documented security objective can bring greater visibility and clarity to offerings, and eliminate chaos.
Clearing Out the Haunted House
The SOC might be a haunted house, but it doesn’t have to stay that way. Security teams—with a little help from vendors—can banish the monsters that restrict their ability to support new projects and leave their organizations vulnerable. There is no single magic spell that can eliminate all these nuisances at once. However, a methodical approach can help security teams make lasting changes that give them greater agility for addressing constantly shifting threats.
A: There are thousands of cybersecurity vendors, and many offer similar capabilities. When evaluating vendors, security teams should focus on the business challenges that solutions address—not the technical features that each solution offers. Creating a one-page decision brief that maps vendors to business impact can help streamline decision-making.
A: Regulations require public organizations to report material security events rapidly. To deliver, organizations should build processes that collect information, streamline decisions, and produce necessary documents. They should then rehearse scenarios with all the teams who need to be involved.
A: Many organizations believe they can implement Zero Trust with a single solution. Instead, it can be a complicated process. Prioritizing implementation of identity controls and obtaining long-term executive commitment can help keep projects moving.
A: Demonstrating the return on investment (ROI) is imperative for gaining continued funding and approval for cybersecurity solutions. Security teams should translate solution capabilities into measurable reductions in breaches, downtime, and compliance work. Highlighting quick wins shows value early, which can help sustain executive support.
