Security Vision
Different maturity models are known in Russia:
- SW SMM (Capability Maturity Model for Software) (appeared as a result of cooperation between the US Department of Defence and the Software Engineering Institute - SEI);
- PMI model (from PMI community): it defines the maturity level in project management (there are other models that assess maturity in project management);
- maturity ideas are contained in the ISO 9000 standard;
- SPICE (Software Process Improvement and Capability determination) model;
- ISO 15504 standard;
- CMMI - integrated technology maturity model.
In this article we will try to look at the maturity model of companies implementing IRP/SOAR class information security systems. There are a lot of interpretations and ways of systematisation here as well. I propose to look at the SOAR maturity model through the eyes of Security Vision specialists, based on the expertise gained from dozens of real implementations of IRP/SOAR class systems.
Building the model
Since we are going to build the SOAR maturity model, I would like to say a few words about the subject area. SOAR (Security Orchestration Automation and Response) is a solution designed to formalise, automate, improve and increase transparency of response processes in a SOC or a company's division responsible for information security.
When building our own model, we decided to use the indicators that, in our opinion, most relevantly reflect the full utilisation of SOAR capabilities and the complexity of tasks faced by companies:
- Content - the range of information a company uses to detect an attack on its infrastructure. Content includes: response scenarios, connectors, role model, metrics, reporting, etc.
- Response scenarios - the playbooks that IS professionals use (or don't use) and the primary purpose of the scenarios used
- Actions - response to a threat, a list of actions available in a given situation
- Degree of automation - how automated the actions to detect threats and respond to incidents are. Total percentage of scenarios and operator actions performed by SOAR
- Level of integration - the number and composition of systems with which interaction is conducted. This may include related information systems, data sources, and external analytical services
- Support and development - how the system is administered and how the functionality is developed, the degree of understanding of the need to update and improve content and processes to keep up with the dynamics of external threats.
We also consciously decided to use 4 maturity levels because it fits better with our chosen metrics and our statistics in general. We thought it would be more fair than adding another level and ‘pulling the owl over the globe’. Of course, in the real world not everything is so definite and companies that are on the third level by some indicators may be on the second or fourth level by others, but we will still try to build a certain image of the company on each level with its own characteristic properties and features.
First level
What distinguishes companies of the first level? The implication is that they have basic monitoring of security events: perhaps a SIEM is implemented in some way, perhaps information is collected from the console and defences. There are no people in the organisation responsible for regular monitoring and response to IS events, meaning the same people administer, analyse and respond. With this approach to monitoring and with these staff capabilities, only critical events are usually handled in organisations at this level, mid and low level alerts tend to be ignored. This can be a foul-smelling SIEM, producing so many events that it is simply not possible to respond with the resources available.
Often tier one companies use MSSP providers to implement 1-2 line response functions.
Tier Two
Tier 2 companies are characterised by reactive response to cybersecurity incidents, which is carried out on a regular basis. IS specialists in such companies monitor and respond to threats based on their personal experience, and the response processes are not formalised in any way. As a rule, such organisations already have a division between response and administration of individual security systems. This gives time for tuning and improvement of processes, respectively, reduces the amount of noise from various sources and thus makes it possible to process the majority of alerts.
In the second level companies, apart from MSSP providers, they often use forensics and malware analysis services (mostly post-facto, when they have already been hacked, to understand the situation; but this is not a bad thing either, because the investigation eliminates the root cause of a successful hack).
Level Three
At the third level, the company has formed a SOC or a separate department responsible only for information security. The processes of monitoring, analysis and incident response in such companies are formalised, which reduces dependence on specific people and gives more opportunities for scaling the SOC. This is already a high level of maturity. Whereas at the first level SOAR was used to record incidents, at the second level response is added, at the third level SOAR is tasked with improving the efficiency of the unit responsible for information security. Such organisations use advanced analytics, modern approaches to analysis and response, engage in their own cyber intelligence, and conduct cyber training to raise the level of their staff.
Level Four
The highest level of maturity is characterised by a proactive response to IS threats. Processes in such organisations are improved on a continuous basis and separate analysts are dedicated to this, and even the approach to process improvement is regulated. Level 4 organisations are resilient to new threats. A significant number of processes are automated, not only response processes, but all processes within the IS department.
This is, of course, a somewhat idealised picture, and in practice few people manage to reach this level, because on the one hand it is very costly, and on the other hand, the company must have a strong motivation, as the process of climbing to the highest level of maturity is always long and difficult.
The maturity model comes in handy
If someone in the process of reading the article asked: ‘What is the purpose of this model?’, I answer - the SOAR maturity model came in handy for us when developing the boxed version of IRP/SOAR 2.0. We realised that the target audience would be different and that the new product should scale well without losing efficiency.
In IRP/SOAR 2.0, for the first time, the concept of dynamic playbooks was implemented, which consists in automatically adapting response plans to the specific situation of a triggered incident, which will just help to increase the efficiency of the incident handling level through automation and expert prompts.
We generally believe that our task is to improve and help optimise SOC centre processes, and if during implementation or operation we manage to increase the IS maturity level, we believe that the job is well done.
