MITRE's publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #1 ‘Know what you are protecting and why’

Ruslan Rakhmetov, Security Vision

As a rule, cyber security for the vast majority of companies and organisations is not the primary goal, but a supporting function that ensures that the company's mission is fulfilled. This means that it is critical for the SOC to understand the context of the IS events it handles and to prioritise the large amount of incoming information. This can only be achieved by clearly understanding exactly what the SOC is protecting and why.

To effectively deliver services to customers, the SOC must understand, maintain and share Situational Awareness (SA) data. SA can be defined as the perception of a customer's cyber security posture and cyber threat landscape in time and space, understanding their interconnectedness (i.e., cyber risk), and predicting their status for the near future. The cycle of situationally oriented decision making follows the OODA cycle (observe, orient, decide, act). In SOC, all analysts, sometimes unknowingly, perform actions in accordance with the OODA cycle, which can last from minutes to months, while continuously increasing the operators' CRM about the customer's infrastructure and cyber threats relevant to the customer. It takes a long time for SOCs to achieve quality CO, but it allows them to provide the customer with timely, relevant information and answer questions of the species:

- What is the state of the company's cybersecurity at the current point in time?

- What are the consequences of a successful cyberattack, including consequences for the services provided and consumed?

- Which attackers are the real threat to the company?

- How are attackers attacking the company and what are their objectives?

- What is the best way to respond to these cyberattacks?

- What is the status of installing security updates on the company's infrastructure, which patch installations should be prioritised?

- To which systems should a particular set of security measures be applied to most effectively minimise cyber risk?

- As cyber threats targeting the company change, as attackers' TTPs change, what does the company need to monitor and defend against these new threats?

- Which of the company's employees or counterparties are performing uncharacteristic behaviour and is this a threat?

CRM in the context of SOC can be categorised into the following 5 areas:

1. Understanding the customer's business and mission.

The SOC must understand the customer company's fundamental business objectives and business processes: what products and services the company offers, its major customers, geographic locations, and relationships with third parties (suppliers, distributors, contractors). Understanding the company's mission will help the SOC understand what the main threats are (e.g., to intellectual property, financial transactions, e-commerce, etc.) and what information security properties are most critical to certain business processes of the company (e.g., confidentiality of customers' personal data, integrity of information processed at the stock exchange, availability of web services for customers).

To perform its functions effectively, the SOC must understand the underlying context of the customer's business mission, including:

- The main lines of business, including all supporting services and functions, and associated revenue and cost metrics

- Geographic and physical locations of business processes

- The alignment and relationships between lines of business and digital assets, services, data, and storage locations.

- Business relationships between the customer company and other companies, organisations, government agencies.

The following practices and techniques can be used by the SOC in conjunction with other IS departments within the company to understand the customer's business:

- Recruit employees in the SOC who have experience in the customer company's business units

- Engage on an ongoing basis with company employees with IS expertise (security champions) and, where possible, include them in the SOC staffing structure.

- Engage on an ongoing basis with company executives and information system owners, providing information about the measures taken by the SOC to protect them, as well as receiving up-to-date information about changes in their business processes.

- Ensure that regular technical training and simulation exercises are conducted for the owners of key information systems

- Maintain and effectively operate a system of records for information assets and services

- Engage and involve the company's IS departments to assess cyber risks and criticality of incidents

- Conduct regular briefings in the SOC on key aspects of business operations, either by engaging SOC staff or inviting business unit representatives.

- Consider business process information when accepting a service for monitoring in the SOC

- Maintain up-to-date business unit information, e.g. through a service register.

2. Understand applicable legal, regulatory and compliance requirements.

The SOC operates in a defined legal environment that is governed by the legal requirements of the country where the business units are present, industry restrictions, and other possible regulatory requirements. The SOC should work in conjunction with the company's legal department to address the following possible legal aspects of operation:

- Types of applicable legal systems

- Types of applicable legal requirements (e.g., criminal, intellectual property or personal data protection laws)

- The role of the SOC in complying with applicable legal and regulatory requirements

- Applicable industry standards (e.g., cyber incident notification rules, personal data retention standards).

The SOC, in conjunction with other IS departments within the company, may use the following practices and techniques to understand applicable legal, regulatory, and compliance requirements:

- Designating legal contacts (e.g., audit coordinators and legal counsel)

- Developing internal SOC regulations that describe the SOC's responsibilities in terms of fulfilling the requirements of the regulations

- Developing guidelines for performing certain legally relevant activities (e.g., collecting computer forensic information).

- Developing a list of internal contacts responsible for supporting regular audits.

3. Understanding the technical environment, critical systems, and data

One of the obstacles to an effective SOC can be a lack of visibility and understanding of the elements of the protected information infrastructure, systems, data, and network traffic. Ideally, the SOC should have information about all of the customer's systems and data, but this can be challenging, so it is possible to focus on aspects such as:

3.1 Location of the customer's digital assets:

- Geographical location of IT and OT infrastructure elements

- Number, type, location, network connectivity of IT and OT assets including PCs, servers, network and mobile devices, IoT devices

- Network topology, including physical and logical connectivity, boundaries between network segments, external connection points

- Asset, network, application architecture (including information on authentication, access control, auditing)

- Information storage locations (e.g., closed network, cloud, mobile devices).

3.2 The level of criticality of the customer's digital assets:

- The most critical types of information and where it is processed and stored

- Which systems perform company-critical functions and which data has higher requirements for confidentiality, integrity, availability.

3.3 The state of the customer's digital assets:

- What condition is considered normal (state) for assets in core network segments and on devices

- Changes in the state of assets, e.g., changes in configuration, device behaviour, ports and protocols used, volume of network traffic

- Device and application vulnerabilities, countermeasures applied to mitigate the possibility of vulnerability exploitation.

To understand the customer's technical environment, infrastructure and data, the SOC, in conjunction with IT, OT and network administrators, and other IS departments within the company, may use the following practices and techniques prescriptively:

- Participate in and maintain a comprehensive inventory of IT and OT assets, including maintaining up-to-date network diagrams and charts of key information systems, collecting and analysing vulnerability scanning reports, maintaining and using a list of the customer company's employees responsible for the systems

- Have access to major IT requisitioning systems and tracking systems used to manage IT changes

- Collect telemetry data and maintain access to IS event sources, including applications and databases for major applications and information repositories

- Utilise network sensors, host sensors, big data analytics, Log Management and SIEM systems.

The publication ‘11 World-Class SOC Strategies’ also highlights the importance of building and keeping up-to-date an inventory of protected assets and their properties, using all available heterogeneous data sources, which can be particularly abundant in large companies. Inventory information should be obtained not only from on-prem devices, but also from cloud infrastructures (PaaS and SaaS, cloud storage), and consider IoT devices and hosts that may be isolated from the network. IT asset data can be obtained from sources such as:

- LDAP directories, Active Directory services

- DHCP data

- Inventory data from various departments (provided in a variety of formats, from Excel spreadsheets to data from comprehensive inventory systems)

- Inventory data from cloud infrastructures

- Data from MDM and EDR solutions, including unknown device detection events

- Network scanner data

- Vulnerability scanner data

- IS solutions that build an asset list based on processed IS events (e.g., SIEM and UEBA systems, some firewalls)

- Systems for configuration management, security updates, software distribution (e.g. Microsoft SCCM, HCL BigFix, Ivanti Unified Endpoint Manager).

4. Understanding users and their behaviour and service interactions

The SOC team needs to understand what typical actions users perform in the course of their job duties, as well as consider the context of the customer's business processes. These analytics, often using machine learning algorithms, are enabled by UEBA platforms that monitor user and technology behaviour, and then identify anomalies and suspicious activities. To operate effectively, a SOC must understand:

- The significance of user actions and entities (access subjects) on the corporate network and on customer devices, taking into account the business context

- The role, importance, profile of key user groups, including system administrators, managers and administrative staff, sensitive information access subjects, external users, other groups

- Description of the typical format of work (using baseline metrics) of users with different systems and data, especially critical ones.

- Processes of authorisation and delegation of authority in the interaction between users and services, as well as between services

- Areas (contours) of trust and interdependencies of trust within the company and within business areas.

To understand users and their actions, as well as the behaviour of services and other entities, the SOC, in conjunction with other IS departments within the company, may use the following prescriptive practices and techniques:

- Keep up-to-date and utilise service and asset inventory data

- Have access to user and application authorisation systems

- Have competencies within the SOC on access control and ‘zero trust’ technologies

- Have access to a knowledge base of the architecture and design of access control systems in use (e.g., information about AD forests and the trust relationships built between domains)

- Gather information about login/logout events of access subjects, user access to objects, and changes to directory objects

- Utilise and maintain the UEBA platform at a level appropriate to the needs of the SOC.

5. Understanding Cyber Threats

Understanding the customer company's business will help the SOC understand what types of external and internal attackers and threats will be relevant and dangerous. To contextualise cyber threat data, the SOC must understand:

5.1 What in the customer's business will be of most interest to the perpetrators? The target of the attack could be, for example, to gain a foothold in the company's infrastructure for further attacks, to obtain ransom after encrypting information, to steal intellectual property and confidential information.

5.2 What types or groups of attackers are likely to attack the company? Attackers can be casual hackers, insiders, hacktivists, experienced cybercriminals, or members of APT groups. Understanding the capabilities of current attackers will help to correctly build a cyber defence system.

5.3 What cyber incidents has the customer experienced in the past? Understanding the types of systems attacked, the data compromised, and the impact and consequences of previous cyber incidents will help prioritise SOC efforts.

The final description of Strategy #1 provides a number of tips to gradually increase the SOC's situational awareness:

1. Increase the level of SOC gradually but continuously and do not seek to achieve a comprehensive understanding all at once

2. 2. Interviews and meetings should be held with users, experts, managers to gain their perspective on what protective measures need to be prioritised

3) Collect a list of regulatory requirements that apply to the SOC's activities

4. continuous assessment of the IT environment for which the SOC is responsible is required.

5. Should work with other parts of the company to improve SOC, e.g., IT department, executives, lawyers

6. Need to identify high priority systems and data, then get information about them in the business context and build models of their normal behaviour and operation using baseline metrics

7. It is recommended to use automation tools to store and contextualise information

8. Together with company executives, SOC's understanding of business priorities should be continuously validated

9. Establish standard operating procedures (SOPs) and TTPs for SOC activities, and conduct drills and exercises for information gathering, incident notification, coordination and reporting as part of efforts to protect the company's business priorities.