FEBRUARY 2021 Sponsored by

INSIDE:
Building the SOC of the Future >>

Security as Code: How Repeatable

Policy-Driven Deployment Improves Security >>

10 Benefits of Running
Cybersecurity Exercises >>

Building the SOC

Can’t Afford a Full-time CISO? Try the
Virtual Version >>

Building the SOC of the Future: Next-Gen

Security Operations >>

of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed
the way business works and the way security teams operate. There is no going back.

Next
FEATURE

Building the SOC of the Future

Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past
year has changed the way business works and the way security teams operate.
There is no going back.
By Rob Lemos

I
n April, health insurance provider Blue Cross system for days, if not weeks, they apparently were
Blue Shield of Kansas City had to scramble. not able to capitalize on their access, says Yaron
Its third-party provider of workstation man- Levi, chief information security officer for Blue Cross
agement services, Cognizant, had notified the Blue Shield of Kansas City.
company that a spate of technical problems and “When a company like that gets hit, and they
service outages had been caused by a ransom- have so many clients, and they work on the cli-
ware attack, reportedly by the notorious Maze ent side and on clients’ systems, the question is
ransomware group. whether we had been hit,” he says. “We had to
The security operations center at Blue Cross respond to the issue, and we had to distance
Blue Shield of Kansas City — or Blue KC, as it our systems from them.”
is known — scrambled to determine whether the The incident, which cost Cognizant $50 mil-
ransomware group had jumped from Cognizant to lion to $70 million and presaged the current
healthcare firm’s network, a possibility since the supply-chain crisis involving network-man-
managed services provider typically runs software agement firm SolarWinds, is one of many that
agents on its clients’ workstations to allow patch- made 2020 a chaotic year, especially for se-
ing and updates. curity operation teams tasked with protecting
Even though the attackers were likely in Cognizant’s corporate data and employees’ systems.

February 2021 2
Previous Next
Building the SOC of the Future

Figure 1. The Importance of SOC Activities

Last March, the coronavirus pandemic forced companies

84%
to send workers home, leaving IT professionals to adapt Minimization of false positives
88%
to a mostly remote workforce. Security operations centers
(SOCs) had to not only secure remote workers but deal 73%
Agile DevOps
85%
with their own virtual operations. At the same time, attack-
ers continued to become more stealthy and — because of 83%
Threat intelligence reporting
the availability of cybercrime services — the average cam- 83%

paign became more sophisticated, using evasion tech- Use of technologies such as automation and 72%
niques to avoid detection and transitioning to the tactical machine learning 80%

use of third parties and supply chains as a vector of attack. 77%

Monitoring and analyzing alerts
No wonder, then, that the complexity in managing today’s 79%
security operations centers has spiked. In its Second An-
77%
nual Study on the Economics of Security Operations Cen- Intrusion detection
79%
ters, the Ponemon Institute found that 81% of companies
69%
considered managing a SOC to be highly complex. More- Cyber forensics
75%
over, that complexity is leading to workforce problems in
71%
the SOC: mainly, increasing workload, always being on Threat hunting
73%
call, and information overload.
Between the proliferation of security tools, threats, and
FY2019 FY2020
alerts, the security team is getting overwhelmed — espe-
cially as they try to adapt in-person processes to remote keep efficiency metrics high without adding new cost, new nesses, the technology that needs to be secured, and the
work, says Eric Parizo, senior analyst for security at Om- complexity, or simply burning out staff even more quickly by impact of current threats.
dia, a business intelligence firm. creating more hoops to jump through,” he says. As we move into 2021, the future of security operations
“When combining these and other challenges, CISOs and Creating a next-generation security operations center is becoming clearer: Virtual, cloud-based, automated, col-
SOC managers are no doubt struggling to determine how to (SOC) requires looking at the forces that are driving busi- laborative, and proactive threat and vulnerability hunting.

February 2021 3
Previous Next
Building the SOC of the Future

In addition, security professionals should be treated as val- stuff,” he says. “It is not like it is something that is sophis-
ued resources, have the desire to learn, and be given the ticated, or crazy, or new. Compromised credentials, ex-
opportunity to advance their careers. posed ports, unpatched systems — it is kind of the same
things we’ve been seeing.”
Forces of Change Instead, changes that have impacted businesses have
The major attack trends of 2020 included the rise of ran- caused greater disruption for those organizations’ security
somware as the dominant financial crime — accounting for operation centers.
81% of all financial-focused attacks, according to Crowd- The primary force for change: The pandemic, which ac-
Strike; the massive nation-state attack that used third-party celerated the move to remote work.

In March, the coronavirus pandemic forced companies to send workers home, leaving IT
professionals to adapt to a mostly remote workforce. Security operations centers (SOCs)
had to not only secure remote workers but deal with their own virtual operations.

software provider SolarWinds as a vector for compromise; Because security teams have had to deal with a distrib-
and the continued focus of attackers on using credentials uted workforce, they have not had adequate visibility into
for compromise. network traffic and threats, while security controls also
While these attack trends were significant — the mas- have suffered. In addition, many SOC analysts and secu-
sive SolarWinds attacks allowed nation-state attackers, rity team members are working remotely as well, revealing
purportedly Russia, to infect thousands of systems and weaknesses in the knowledge management processes in
compromised dozens, and perhaps hundreds, of govern- many SOCs as information is not always passed along as
ment agencies and private companies — they were not efficiently as it is with in-person conversations, says Mi-
surprising, says Blue KC’s Levi. chael Hamilton, founder and chief information security offi-
“The reasons for the compromises are still the same old cer at CI Security, a provider of managed security services.

February 2021 4
Previous Next
Building the SOC of the Future

Figure 2. What Makes Working in the SOC Painful?

“Monitoring their environments was previously predicat-
More than one response is permitted
ed on buildings full of people behind a variety of preventive
controls,” he says. “But that rapidly changed to home net-
works with unknown controls that access corporate and 75%
Increasing workload causes burnout
80%
government networks using a variety of methods – some
69%
demonstrably insecure.” Being on call 24/7/365
73%
More than a third of SOCs have changed to remote work, 65%
Information overload
and more than half of security analysts and incident re- 71%
65%
sponders have experienced a decline in performance, ac- Too many alerts to chase
64%
cording to the Ponemon’s Study on the Economics of Se- Lack of visibility into the network and IT 68%
curity Operations Centers. infrastructure 63%
64%
Even before the pandemic, however, business changes Inability to recruit and retain expert
personnel 61%
were already impacting SOCs. Digital transformation ini- 53%
Inability to capture actionable
tiatives — key among them, moving to agile DevOps-style intelligence 61%
development and operations — had already forced securi- Complexity and chaos in the SOC
54%
60%
ty teams to contend with the speed of innovation.
58%
In terms of SOC priorities, agile DevOps gained the most Inability to prioritize threats
55%
momentum in 2020, gaining 12 percentage points, to be- 49%
Losing to adversaries
come second place in the list of SOC priorities, right after 51%
Inability to effectively collaborate with 44%
the minimization of false positives, according to Ponemon’s IT teams to manage threats and risks 49%
report. Using automation and machine learning — another 52%
Lack of resources
SOC focus — gained the second most momentum, rising 49%
1%
8 percentage points. Other
0%
The key is to use the automation and development-to-
production focus of DevOps to create a self-checking system FY2019 FY2020

February 2021 5
Previous Next
Building the SOC of the Future

of deploying devices and applications that result in cleaner Safran, founder and CEO of KeyCaliber and former leader
environments, says CI Security’s Hamilton. of cybersecurity operations for the Executive Office of the
“If customers are more secure, the SOC has fewer events President during the Obama administration.
to investigate,” he says. “The upside of both of these problems is that organiza-
Another trend that has resulted in greater complexity for tions have been forced to solve them [in 2020] when they
security operations centers is the proliferation of connect- could have put them off in the past, and dealing with these
ed devices and operational technology (OT) whose securi- problems will improve SOC operations,” Safran says.
ty now has to be managed. Security analysts have to figure
out how to integrate products outside their expertise into Evolving the SOC
the security portfolio. Often, such steps result in the adop- Companies are taking steps to address all these concerns
tion of technology that — such as Internet-of-Things and because security operations centers and capabilities have
OT asset discovery products — is completely new. become a very important part of many organizations’ goal
One other trend has stymied SOCs as well: Keeping the to establish a strong security posture, says Larry Ponemon,
security team fully staffed. founder and principal analyst at the Ponemon Institute.
While salaries grew significantly in 2020 — with the av- “A lot of companies are developing SOCs, making major
erage salary for a Tier 1 analyst growing from $102,000 to modifications to their technology mix, or hiring people who
$111,000 in the past year — on average, three analysts are specialists,” he says. “We noticed this around the last
are expected to resign or be fired in the next year, while two or three years, but in the last year, things have really
only five will be hired, according to Ponemon’s report. The changed, in part because of the pandemic.”
average analyst only remains at their job for a little over The result will be a security operations “center” less fo-
two years, the survey found. Without companies retaining cused on a physical space and more on the capability,
knowledgeable and skilled workers, security will continue says KeyCaliber’s Safran.
to be elusive for businesses. “Security operations entails so much more than just triag-
All of these issues — while disruptive — will likely leave ing and responding to alerts these days,” she says. “Creat-
companies better prepared for the future, says Roselle ing separate, non-SOC units for the various functions that

February 2021 6
Previous Next
Building the SOC of the Future

need to work in concert with detection and response —

such as vulnerability management, threat intelligence, et
cetera — just leads to silos and inefficiencies.”
A key characteristic of the next-generation SOC is a fo-
cus on the endpoint.
Because of the expanding remote workforce, security op-
erations will focus on the endpoint and less on the firewall.
Even with employees working from home, endpoint detection
and response (EDR) — or extended detection and response
(XDR), as some call the technology — should be consistently
deployed, says Ed Hunter, chief information security officer
of InfoBlox, an automation and security company.
“If you have the right tools on the endpoint, you can
have as good visibility as you had on premise,” he says.
“You have to look at where you are getting your data and
where you are getting your alerts over time. If you have a
next-generation firewall, and you put all your eggs in that
basket, you are blind.”
Part of this focus is moving to a zero-trust concept for se-
curity, attesting to the security of each transaction between
a user, device, business data, and corporate infrastructure.
More than 70% of organizations are considering a move to
a zero-trust model for security, according to one report.
Because remote work has not just impacted the de-
vices that the security team needs to protect but also

February 2021 7
Previous Next
Building the SOC of the Future

the infrastructure that is used to protect them, two other Yet, with the broad proliferation of automated technolo-
characteristics are needed in the next-generation SOC: gies comes concerns that unsupervised automation tak-
It should be cloud-enabled — or better yet, cloud-na- ing major response actions could cause problems. This
tive — and use mature communication and collaboration means that businesses need human oversight for their
platforms. SOC systems.
With more than half of cloud workloads and data expect- “I believe there is going to be more and more usage of
ed to be in the public cloud in 2021, security operations that technology to drive better outcomes,” says Levi. “I
need to adopt the same infrastructure. Yet, securing busi- think [that approach] is over-marketed right now. We have
ness infrastructure in the cloud is the most consistent chal- to figure it out first, and then we can automate a bunch
lenge for companies, with 83% of firms having trouble se- of things—weird connections and things that people can
curing their workloads in the cloud, according to Flexera’s think of.”
State of the Cloud 2020 report. High performing security operation centers (SOCs) are
Security operations needs to be cloud aware and cloud able to limit the impact of security operations on their
native, says Omdia’s Parizo. workers. Only 42% of respondents who categorized their
“There simply is no longer tolerance for SOC technolo- SOC as high performing had analysts burning out because
gy that isn’t cloud-enabled,” he says. “Organizations need of the high pressure environment, compared to 75% for all
to have consistent performance and functionality from the respondents. In addition, only a quarter of high-performing
SOC tools they use, especially their high-dollar commer- respondents considered the SOC’s return on investment
cial solutions, and to ensure that in a distributed environ- to be getting worse, compared to more than half overall.
ment, solutions must be delivered from the cloud.”
In addition to working in the cloud, security operations Getting to Next-Gen Security Operations
needs strong knowledge-management and collaboration While not every business will have a physical security op-
capabilities to offset the isolation caused by remote work. eration center, every organization should be consolidating
Automation is essential to reduce work and connect and improving their security operations in 2021 to reduce
the security events that might otherwise escape notice. cost and improve effectiveness, says KeyCaliber’s Safran.

February 2021 8
Previous Next
Building the SOC of the Future

“Not every organization needs an internal SOC, but ev-

ery organization needs to have SOC functionality,” she
says. “For small organizations it usually makes sense to
outsource the capability to a reputable managed securi-
ty-service provider because they don’t have the resources
to build a program internally.”
Experienced security analysts are key. Basic Tier 1 func-
tionality should be automated, but companies should have
the staff to focus on higher level operations, such as threat
hunting, vulnerability management, threat modeling, and
identity and access management, she says.
Security teams should resolve to include business deci-
sion-makers more often in deliberations. Companies have
generally not managed cyber risk very well: Take sup-
ply-chain risks. Business leaders are usually the ones that
determine who a company does business with, but security
operations should have input as well. The solution lies not centives, understand the exposure, and educate the busi- likely be necessary, not just in the face of the epidemic, but
with business executives or security professionals but with ness based on those risk decisions, he says. to better monitor and protect the endpoints.
the two groups working together, says Blue KC’s Levi. The business discussion is important because more than “We are focusing on zero-trust monitoring and rapid
“As an industry we have failed miserably to manage risk half of companies of companies see the return on invest- quarantine – using the assumption that the new distributed
properly,” he says. “We focus too much on compliance of ment (ROI) of their security operations centers growing workforce isn’t going back to commuting when they get a
third parties, but what do we do when we contract a third worse. Yet, among high-performing security teams, only vaccine,” says CIS’s Hamilton.
party? We send them a questionnaire; but as a control, se- a quarter of companies believe the ROI is getting worse, In 2020, the average organization surveyed by the Pon-
curity questionnaires are completely ineffective.” according to Ponemon’s study. emon Institute spent $183,000 on security information and
The security team needs to understand the business in- From a technology standpoint, a zero trust approach will event management (SIEM) systems, $345,000 for security

February 2021 9
Previous Next
Building the SOC of the Future

orchestration, automation, and response (SOAR) platforms, they don’t have prior experience,” KeyFactor’s Safran says.
$285,000 for managed detection and response (MDR), and “Considering how much needs to be learned on the job for
$333,000 for extended detection and response (XDR), ac- any SOC hire, there’s no reason why some of the open
cording to the Ponemon findings. positions can’t be filled by rookies with strong potential.”
Yet, simplification is important as well. Making all those The best approach is not just to train security profession-
tools work together and work well takes time and mon- als but to work on retaining the ones that you have, says
ey, according to the Ponemon Institute. The average ex- Omdia’s Parizo.
penditure on security engineering is $2.7 million, which “The best SOC staff-retention programs feature common
includes merging and integrating security data for use by themes,” he says. “Such as competitive salary and bene-
the various tools, creating rules to detect threats, auto- fits, reasonable goals and expectations, opportunities to
mating security processes, and hunting for threats. De- conduct a variety of tasks, ongoing skills and career devel-
spite all that, only 23% of security professionals rated opment opportunities like paid trainings and conference
their efforts as effective. attendance, and real chances to make an impact and in-
Finding tools that already work well together is import- fluence cybersecurity strategy decisions.”
ant, says InfoBlox’s Hunter. The next-generation SOC will also feature better collabo-
“We have so many different tools, everyone ends up ration environments to replace the valuable interaction and
being a portfolio manager,” he says. “That is the bane of information exposure that an analyst would otherwise have
security people’s existence. Basically, whenever there is a when working in a physical security operations center. For
new threat, the answer is ‘here is a new tool.’” some security professionals, the potential loss of that in-
One critical factor will stymy the evolution of any SOC: teraction is the worst aspect of going remote.
Security workers with the right knowledge. About a third of Having security analysts in the same room allows easy
companies plan to increase their security team by at least access to expertise and frictionless learning, says Chris
six analysts, according to Ponemon’s report. Triolo, vice president of customer success at Respond
“There are plenty of candidates who are trying to break Software, a security incident response firm.
into the field but are not being given the chance because “You want to put analysts in the same room together,” he

February 2021 10
Previous Next
Building the SOC of the Future

says. “You want to layer junior and senior people together. erations now possible with advancements such as cloud,
They can do on the job training. They do the whiteboard. automation, and proactive threat and vulnerability hunting,
They will discuss whatever is currently significant.” for example. Today, however, those changes are here to
Finally, SOC analysts need to not only remain up-to-date stay, says InfoBlox’s Hunter.
on attack techniques but also their company’s weakness- “Our SOC used to be a physical SOC where everyone sits
es. Red teams and penetration testers frequently test the in one area, and that is the way we did things,” he says. “If
defenses at Blue KC to make sure that a security weak- this had happened 10 years ago, the rush back to the office
ness has not inadvertently been opened in the company’s would have been quicker. Now that we have proven that they
defenses, says CISO Levi. can work remotely and effectively, there is no going back.”

One critical factor will stymy the evolution of any SOC: Security workers with the right
knowledge. About a third of companies plan to increase their security team by at least
six analysts.

“We don’t just sit and wait to see who is attacking us — About the Author: Rob Lemos is a veteran technology journalist of
we are attacking ourselves,” he says. “We have a set of more than 20 years. Former research engineer. Written for more
defenses in place that we have invested in — EDR, than two dozen publications, including CNET News.com, Dark
anti-malware, others — but how do we know they are Reading, MIT’s Technology Review, Popular Science, and Wired
working? So we are attacking ourselves and we are con- News. Five awards for journalism, including Best Deadline Jour-
tinuously looking at where could we be compromised, nalism (Online) in 2003 for coverage of the Blaster worm. Crunches
where there are the gaps.” numbers on various trends using Python and R. Recent reports in-
If the COVID-19 pandemic had occurred a decade ago, clude analyses of the shortage in cybersecurity workers and annu-
the technology and security maturity would not have been al vulnerability trends.
ready to make the transition to the type of security op-

February 2021 11
Previous Next
COMMENTARY

Security as Code: How Repeatable Policy-

Driven Deployment Improves Security
The SaC approach lets users codify and enforce a secure state of application
configuration deployment that limits risk.
By Dan Hubbard

T
he adoption of infrastructure as code (IaC) practices to why there is a real need for organizations to take a “securi-
help automate and accelerate IT operations has really ty as code” (SaC) approach to fully recognize the benefits of
taken hold in recent years — even more so during the automation that composable, repeatable, and fully auditable
pandemic. infrastructure can provide.
With IaC, organizations are moving away from a model where
humans are required to make manual changes in order to con- IaC Requires A New Security Approach
figure and deploy application infrastructure, both on-premises Simply put, securing automation code is critical because in many
and more often than not, in the cloud. IaC offers the promise cases it literally runs our businesses. IaC systems are automatical-
of automation and repeatable predictable patterns for software ly deploying resources and applications. A vulnerability or a mis-
infrastructure deployment. There are multiple popular models configuration in an IaC workflow could have a cascading impact,
and services used today for enabling an IaC approach, in- across multiple workloads and deployments that could enable a
cluding Terraform, Chef, Puppet, Ansible, SaltStack, and AWS potential attacker to cause a lot of damage. IaC is very powerful,
CloudFormations. so when mistakes happen, they happen fast, and exponentially.
While the approach has many benefits, traditional security One of the challenges with securing automated workflows is
approaches typically slow down the software development there can often be multiple paths into a system or service for
life cycle and can evaporate the benefits of using IaC. That’s executing an action. There could also well be multiple people

February 2021 12
Previous Next
Security as Code: How Repeatable Policy-Driven Deployment Improves Security

from different parts of the organization that have access to the various entry points for IaC.
Adding further complexity is that some organizations might not be effectively communicat-
ing about objectives and required changes across a distributed organization.

Core Security Principles

A primary foundation for securing infrastructure created and managed by IAC templates is
by first establishing a source of truth for configuration. There needs to be a codified version
of configuration, usually in a Git software repository, that defines the desired state of con-
figuration. It’s an approach that some refer to as GitOps, which helps to enable IaC. With a
defined source of truth, it’s time to implement access, audit, and review processes.
• Access control. With a defined source of truth for configuration, secure controls
can and should be applied. There needs to be access control that strictly defined
who can access and make changes to the configuration code
•Auditing and compliance. Controlling access is only the first part of security IaC. All
changes need to be audited and monitored for compliance with corporate policy and
regulatory compliance frameworks.
• Review. Even with auditing and access controls, changes that might not be ideal can
still slip through the cracks. That’s why it’s imperative to also actively have a change
management and review process to further validate the state of IaC configuration and
any changes.

Define a Single, Secure Path to Production

To fully secure IaC, there also must be a well-defined single path to production, so that
all stakeholders in the organization, including developers, operations, and security are
involved.

February 2021 13
Previous Next
Security as Code: How Repeatable Policy-Driven Deployment Improves Security

Defining the path to production is often about breaking places. The SaC model can help to effectively eliminate
down silos within the company and focusing on cross- that risk.
team collaboration. More often than not in the past, de- By running continuous compliance assessments of
velopers have viewed security as a blocker and not as cloud environments, an organization can be alerted when-
an enabler. The security-as-code approach can help to ever an S3 bucket has been inadvertently provisioned with
change that mindset by working with developers in a lan- public read or write access. An administrator can then go
guage they understand: code. to the Git repository where the configuration code for the
A key concept that we have seen work well is the use of IaC service is defined and make the required change to
guardrails, rather than gates, as part of the SaC process. eliminate the risk. After the change has been committed,
Rather than implementing a gate, where code cannot it can get through the approval process, and once accept-
pass through unless it is approved by security, a guard- ed, the IaC pipeline can execute the code to remediate the
rail keeps code within certain defined boundaries, that issue across all deployments. The entire process is logged
limits risk. and auditable as well.
Guardrails can help developers and organizations to Mistakes happen, and vulnerabilities seem to come
focus on speed, in a way without sacrificing security. from new places all the time. But with the SaC approach,
it is possible to codify and enforce a secure state of ap-
Security as Code in Practice plication configuration deployment that limits risk.
How does it actually work to improve security? The real-
ity is that with continuous visibility you can ensure cor- About the Author: Dan Hubbard is CEO at Lacework, driving innova-
rectness, alert and then correct any divergence in a re- tion and expanding the company’s security strategy for public and
peatable, auditable, secured approach. private clouds. A pioneering force in Internet security, Dan’s exper-
Here’s just one example where this approach can help. tise spans from reputation and advanced classification systems to
The issue of unsecured cloud storage buckets, often large-scale security data mining, and cloud security. Prior to Lace-
on Amazon S3, is one that is well documented and has work, Dan was CTO at OpenDNS, helped deliver the world’s largest
been reported on extensively at Dark Reading and other cloud security network that led to the $600M acquisition by Cisco.

February 2021 14
Previous Next
COMMENTARY

10 Benefits of Running
Cybersecurity Exercises
There may be no better way to ascertain your organization’s strengths
and weaknesses than by running regular security drills.
By Steve Durbin

K
eeping information secure is a difficult task, even if you have bountiful resources.
With companies like Nintendo, Twitter, Marriott, and Zoom all suffering high-profile
data breaches recently, it’s clear that no one is safe from cybercriminals. While most
organizations understand the need to build defenses and develop policies to reduce the
risk and potential impact of a successful cyber attack, many fail to rigorously test those
defenses.
Cybersecurity exercises are useful simulations of specific cyber attack scenarios that
enable organizations to gain valuable insights into their real-world response. From basic,
small-scale, brief tests to complex, wide-scale, sustained attacks, cybersecurity exercises
can provide verification that your defensive strategy is effective or highlight weaknesses that
require immediate attention.
Despite their importance, 74% of respondents to the ISF Benchmark stated that they do not subject
critical systems under development to cyber attack simulations or exercises. This may be because cyberse-
curity exercises are perceived as time-consuming, expensive to run, and potentially disruptive. If planned prop-
erly, there’s no reason that should be the case. Cybersecurity exercises can deliver some truly compelling benefits.
Consider these 10 examples of how.

February 2021 15
Previous Next
10 Benefits of Running Cybersecurity Exercises

Identify Your Strengths Define Costs and Timescales

There’s a lot of focus on uncovering weaknesses and problems during cybersecurity exer- In preparing for attacks, many assumptions and estimates are made about what resourc-
cises, but there’s also major value in identifying what’s working well for your organization. es are required to handle different scenarios and how long it will take to resume normal
Robust strategies can be emulated elsewhere, smart policies can serve as templates, and operations after an attack. Cybersecurity exercises paint a clearer picture of the costs
effective employees can help to train others. and timescales involved, giving you hard data to help you build greater resilience, or use
for any financial justification that might be required.
Improve Your Response
Perhaps the most obvious benefit of running a cybersecurity exercise is that it gives you Determine External Needs
an opportunity to improve your response to future attacks. An exercise may back up the It’s unrealistic, even for many major organizations, to maintain a team capable of
theory behind your defensive strategy with evidence, or it might point to the need for a handling any attack scenario without external assistance. Which attack scenarios re-
fresh approach. Either way, it will drive you to improve. quire external help? How quickly can external expertise be secured? How much will it
cost? Running security exercises can help to answer these questions.

Collect Metrics
Practice makes perfect. It’s common sense to accept that
Setting expectations for how swiftly different aspects of an attack should be handled and
rehearsals serve an important function in readying people for
how effective defensive actions should be is vital in defining your strategy. But you can
the actual event. Cyber attacks are inevitable, but it’s how
only prove that they are being met when an attack occurs, or by employing a security
you respond that will dictate the impact on your business.
exercise. This data should inform future strategy and guide your approach.

Identify Your Weaknesses

Train People Whether there are technical vulnerabilities lurking on your network or weaknesses in se-
There’s no substitute for hands-on experience. Cybersecurity exercises provide employees curity controls, cybersecurity exercises can expose them. They may also reveal the need
with practical experience of dealing with an attack, they boost awareness of the possi- for better training or new talent. Identifying specific weaknesses enables you to craft re-
bilities, and they can teach people all about the right way to respond. Learning is always mediation plans and act immediately to improve.
more effective with a practical component.

February 2021 16
Previous Next
10 Benefits of Running Cybersecurity Exercises

Update Your Policies nature of cyber-attacks and the scale of

If your current policies, standards, and the threats they pose can be catastroph-
guidelines aren’t effective then it’s time to ic. Failure to recognize the risk and react
revisit them. Effective incident response accordingly always exacerbates the prob-
policies will drastically reduce the poten- lem, making a bad situation much worse.
tial damage and disruption a cyber-attack Practice makes perfect. It’s common
can wreak. Regular policy revision is im- sense to accept that rehearsals serve an
portant and security exercises can provide important function in readying people for
useful evidence to guide that revision. the actual event. Cyber attacks are in-
evitable, but it’s how you respond that
Find Non-Compliance Risks will dictate the impact on your business.
The potential cost of breaching legal, Not only do cybersecurity exercises help
regulatory, or contractual requirements to build awareness and understanding
is enormous, even if that breach is un- across your organization, they test your
witting. Exposing compliance issues can defenses, identify strengths to build on
prove difficult, but that does not mean and weaknesses to mitigate, and offer in-
they don’t exist. Cybersecurity exercises valuable practical experience.
can help to uncover areas of non-com-
pliance, giving you an opportunity to fix About the Author: Steve Durbin is CEO of the
them and avoid unnecessary legal – and Information Security Forum, an independent,
financial – exposure. not-for-profit dedicated to investigating, clar-
ifying and resolving key issues in information
Increase Threat Awareness security and risk management. He is a frequent
From entry-level employees to the board speaker on the Board’s role in cybersecurity
of directors, lack of awareness about the and technology.

February 2021 17
Previous Next
COMMENTARY

Can’t Afford a Full-time CISO?

Try the Virtual Version
A vCISO can align a company’s information security program to
business strategy and budgeting guidance to senior management.
By John Roman

E
nsuring the confidentiality, availability, and integrity of nonprofits) do not have a need for a full-time CISO or the
a company’s, their users’, and their customers’ infor- financial resources to add another member to the C-suite,
mation must be top priority for organizations, but it’s not to mention their 6-figure salary. For those organizations,
easier said than done. Data security breaches and cyberat- there’s another option: a virtual CISO (vCISO).
tack threats are occurring more frequently – according to a For a fraction of the salary of a full-time CISO, companies
recent Information Systems Security Association and Enter- can hire a vCISO, which is an outsourced security prac-
prise Strategy Group survey, 63% of cybersecurity profes- titioner with executive level experience, who, acting as a
sionals have seen an increase in cyber-attacks related to the consultant, offers their time and insight to an organization
pandemic – which means businesses today need to take on an ongoing (typically part-time) basis with the same skill-
additional steps to remain secure. set and expertise of a conventional CISO. Hiring a vCISO
An organization’s in-house chief information security offi- on a part-time (or short-term basis) allows a company the
cer (CISO) is critically responsible for establishing and main- flexibility to outsource impending IT projects as needed.
taining the enterprise information security vision, strategy, A vCISO will work closely with senior management
and program to ensure information assets and technolo- to establish a well communicated information security
gies are adequately protected. However, the reality is, some strategy and roadmap, one that meets the requirements
companies (particularly small- to mid-sized businesses and of the organization and its customers, but also state

February 2021 18
Previous Next
Can’t Afford a Full-time CISO? Try the Virtual Version

and federal requirements. Most importantly, a vCISO may not have the time or resources to properly manage all
can provide companies unbiased strategic and opera- IT functions, especially as they relate to information secu-
tional leadership on security policies, guidelines, con- rity. A vCISO can align a company’s information security
trols, and standards, as well as regulatory compliance, program to a business’s overarching strategy to provide
risk management, vendor risk management, and more. predictive budgeting to senior management.
Since vCISOs are already experts, it saves the orga- For organizations that already have a CISO, a vCISO is
nization time and money by decreasing ramp-up time. particularly useful as a trusted information security advisor
Businesses are able to eliminate the cost of benefits and to the present CISO. If you’re a growing organization, or
full-time employee onboarding requirements. Also, if an- between CISOs, then a vCISO will help avoid rushing the
other employee had been handling the responsibilities of a long process of hiring the right full-time CISO.
CISO, a vCISO frees up some of their workload, enabling There are also disadvantages to hiring a vCISO. One is
them to take on other priority tasks. that the vCISO most likely will need time to understand the
As an example, I am currently the vCISO for four compa- culture and business operations of a company. Second,
nies ranging in size from 40 employees up to 15,000. My depending on the contractual arrangements made, a com-
typical responsibilities include ensuring compliance with pany can have unrealistic expectations that they are get-
state cybersecurity guidelines such as New York’s SHIELD ting a full-time person for the cost of someone who works
Act or Massachusetts’s Cybersecurity Regulation – both less than 20% of the time. The truth is, vCISOs most likely
of these regulations require companies to have a CISO. As have other clients who they are involved with, so unless a
a vCISO, I prepare annual information security budgets, company is hiring a vCISO full time, his or her time may be
identify key security initiatives for the coming year, perform split between multiple companies.
annual risk assessments, work with technology vendors Finally, those who market themselves as vCISOs may lack
on behalf of my clients, and provide advisory services the current knowledge of the industry. While these vCISOs
to senior management on the latest information security may have 30-40 years of technical experience, they may
threats. In any given month, I spend 4-20 hours per client. lack managerial security experience. They may also have
Many in-house IT departments are multi-faceted and been out of the industry for several years due to retirement

February 2021 19
Previous Next
Can’t Afford a Full-time CISO? Try the Virtual Version

or downsizing and have not kept up with security industry trends,

rules, regulations, and models. Therefore, care must be taken to
properly vet a vCISO’s experience.
Information security is complex and everchanging. New vul-
nerabilities and threats are identified daily. Keeping up with
threats, risks, and vulnerabilities is often a full-time job in larger
organizations. Developing a strategic information security plan
and program is a difficult task, and not everyone has the skills or
the time to do it effectively. The right vCISO can provide a busi-
ness with quality executive level information security experts by
collaborating with executive management to make smart deci-
sions on various security, privacy, and compliance requirements
and issues.
A seasoned vCISO will have had the advantage of seeing hun-
dreds of companies struggling with many of the same challeng-
es, and knows which policies, procedures, and technologies are
best for solving specific problems. Overall, the main objective of
a vCISO is to act as a bridge to the business and its technology
team by providing a long-term framework that can be continu-
ously modified as information security goals and threats evolve.

About the Author: John Roman is President and COO of The Bonadio Group’s
Information Risk Management and Cybersecurity Division, FoxPointe Solu-
tions. In his role at FoxPointe, he is responsible for all aspects of the oper-
ations of a national cybersecurity consultancy.

February 2021 20
Previous Next
SPONSORED CONTENT

INFOBLOX PERSPECTIVES

Building the SOC of the Future:

Next-Gen Security Operations
By Bob Hansmann

I
n only three decades, cybersecurity has grown from firewall and and other resources to help detection and IR capabilities keep pace
desktop antivirus products to a complex array of tools and ser- with increasingly evasive threats. This need persists even as the shift
vices. To manage it all, the SOC was created and continues to to cloud continues.
evolve with some impactful changes on the horizon in the areas of
visibility, cyber threat intelligence (CTI), and automation. Maximizing the Value of CTI
Many large enterprises have used a multi-vendor approach to security
Mining the Gold Beneath Your Feet for decades, believing that no single vendor could always be first to
There is a story of a farmer who sold his farm to search for gold, detect an emerging threat. A dozen universities across Europe
while the buyer of that farm noticed things that led them to discover and North America validated this approach recently
gold under the farm. Similarly, security teams are finding that core through separate CTI comparison studies that
network services provide a rich source of metadata that can improve highlighted that there was a minimal amount
detection of increasingly evasive threat activity and provide valuable of overlap between threat feeds.
context to speed more confident incident response (IR). Beyond detection support, CTI helps pro-
Everything, including malicious activity, interacts with these ser- fessionals understand an attacker’s motives
vices and leaves a trail. The SOC of the future needs greater visibility and thought processes and can be broken down
into network data like DDI (DNS, DHCP, and IPAM), Active Directory, into strategic, tactical, and operational categories. As

February 2021 21
Previous Next
Building the SOC of the Future: Next-Gen Security Operations

the threat landscape continually evolves, SOC teams need to choose solutions or as part of a broader security platform.
and continuously monitor a blend of open source, paid for, vendor-pro- But a 2020 SANS survey found that forensic platforms were among
vided, and even internally generated CTI data. The SOC of the future the least automated, particularly in gathering and moving data be-
will require vital CTI programs that include exchanging pertinent threat tween systems. SOC teams need to tackle this deficiency with tools
intelligence with other organizations. that automatically gather and filter network and other metadata to
present analysts with only the data they need at the start of their
Using Smart People Wisely investigation. Security leaders have reported that automating these
In an industry already suffering from information overload, the SOC of essential functions can help reduce average investigation times by
the future will need to embrace automation to take full advantage of half or more.
this additional visibility and threat data and to free skilled personnel
to focus on those tasks that require their experience. Get Security Tools Talking
Overall threat defense will improve as CTI data is automatically col- Vendors are introducing more significant support for APIs and tech-
lected, normalized, and distributed across the entire defensive secu- nologies like STIX/TAXII to better coordinate and automate critical
rity stack, including remote worker protections. In times of crisis, this functions with other security tools, even from different vendors.

Today, a potentially malicious DNS request can trigger an endpoint

vulnerability scan or automate other common troubleshooting tasks before
escalation. Or a well-understood alert could be automatically routed to
trained but less experienced personal through a support ticket system.

process can be used to quickly deploy critical IoCs across multiple Today, a potentially malicious DNS request can trigger an endpoint
solutions after entering them into one system. These capabilities are vulnerability scan or automate other common troubleshooting tasks
available in threat intelligence platforms (TIPs) offered as standalone before escalation. Or a well-understood alert could be automatically

February 2021 22
Previous Next
Building the SOC of the Future: Next-Gen Security Operations

routed to trained but less experienced personnel through a support ticket

system. Capabilities such as these can free your hard-to-find, highly skilled
analysts to focus on those things that only they can do and that they do best.

The SOC of the future needs to detect

breaches faster and accelerate IR to stop
increasingly evasive attacks and reduce
dwell-time.

The tools to provide these automation and integration capabilities will contin-
ue to range from scripts to Security Orchestration, Automation, and Response
(SOAR) solutions. More vendors will be part of ecosystem partnerships to
directly offer a greater range of “make-sense” automation features to reduce
the complexity of incorporating greater levels of automation.

Time Is the Enemy

The SOC of the future needs to detect breaches faster and accelerate IR to
stop increasingly evasive attacks and reduce dwell-time. It starts with ex-
panding visibility into core network services and leveraging a blend of CTI to
improve threat detection and provide context for faster IR decision making.
To improve operational efficiency while ingesting more data, and with an on-
going skill shortage, the SOC will need to embrace automation by demanding
tools with greater integration and automation capabilities.

February 2021 23
Previous Next
Building the SOC of the Future: Next-Gen Security Operations

Infoblox enables next-level network experiences with its Secure

Cloud-Managed Network Services. As the pioneer in providing the
world’s most reliable, secure, and automated networks, we are re-
lentless in our pursuit of network simplicity. Infoblox has over 8,000
customers, including 350 of the Fortune 500, and is recognized as
the industry leader in the DDI networking market.

About the Author: Bob Hansmann has over three decades of security
experience having worked in everything from engineering and threat
research to product management and marketing, including launching
a number of security industry firsts. Working with global enterprises
and government agencies to uplift their cyberthreat prevention, detec-
tion, investigation, and response capabilities has given Mr. Hansmann
a unique perspective on overcoming the challenges of balancing
security needs with an organization’s success requirements.

Learn more at infoblox.com

February 2021 24
Previous