MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #9 ‘Communicate, Interact, Share Information’

Ruslan Rakhmetov, Security Vision

In order to increase the efficiency of SOC-centre work, it is important to ensure interaction within the team of the SOC itself, as well as cooperation with employees of the customer company and with external organisations. The authors of the publication believe that it is important for the SOC to be a part of the customer company's business ecosystem, so it is important for the SOC to consider business priorities and interact with the customer company's representatives and stakeholders, providing them with the IS context. To improve internal IS expertise and the quality of services provided, it is important for the SOC centre to build interaction both within the team and with the external IS community. The processes of building interaction, co-operation, and information sharing are the focus of Strategy 9.

No single professional knows everything in the IS world, so it is important for SOC centres to establish relationships and ways to share information with colleagues who may work both within the client company and in other SOC centres and companies. It is important to provide valuable information, insights, and guidance to company executives in order to obtain sufficient funding and support. It is also important for SOC centres to conduct some kind of public activity (speaking at conferences, publishing notes in the company blog, etc.), which will help to create a positive image of the SOC for both future clients and potential candidates. It is important to envisage in advance the forms of communication (sending and receiving information), interaction, information exchange within the SOC, with company representatives (stakeholders, managers), with the IS community.

1. Interaction within the SOC

First of all, it is necessary to build forms of communication, interaction, information exchange within the SOC itself. Despite the fact that SOC leaders and managers are traditionally considered to be responsible for this area, it is important to give the opportunity to participate in these activities to all members of the SOC team for the most effective use of human potential within the SOC. These activities have the following objectives:

- Training all SOC employees in their job responsibilities through awareness and knowledge sharing;

- Transferring operational information between SOC team members;

- Creating, planning and sharing information about SOC activities;

- Solving problems and tasks together;

- Improved feedback handling of SOC tools, technology, data, analytics to improve their effectiveness.

1.1 Train all SOC employees on job responsibilities:

Approved processes and documentation will help ensure clear and logically linked interactions between SOC team members, particularly documents such as response scenarios and standardised operating procedures (SOP, standard operating procedure).

1.2 Transfer of operational information between SOC team members:

The transfer of information between colleagues within the SOC can be accomplished in the following ways:

- IS incident tracking;

- Tracking of cyber threat analytics, IOCs, attackers;

- Status of cyber threat detection and analytics work;

- Implementation and development work;

- Planning and execution of proactive cyber threat hunting activities;

- Sprint planning, task execution;

- Updating on the status of important incidents and cases;

- Daily planning and shift handovers (larger SOC centres may have town hall meetings and separate meetings for each area of SOC activity);

- Monthly or quarterly general large meetings, direct interaction between members of different teams, team building sessions.

1.3 Establish, plan and share information about SOC activities:

There should be openness in providing information about the current and planned expenditure of resources by the SOC centre. To improve efficiency, planning should be open to all SOC members, which can be achieved through regular planning, flexible scrum planning, accounting and monitoring of SOC functions, e.g. by using a scorecard showing the main functions, capabilities, services of the SOC and their current status.

1.4 Collaborative problem and task solving:

Collaborative work of analysts on complex problems, joint incident response and collective proactive actions improve the quality of SOC services and employee engagement. This is achieved through joint analysis and the use of collaborative tools such as instant messaging platforms, screen sharing solutions, case management and cyber intelligence data management systems, knowledge bases (e.g., Wiki-like), monitoring and planning tools (e.g., Jira, AzureDevOps, etc.). SOC centre managers need to build a supportive environment of communication and interaction between team members, ensure that everyone can express their ideas and suggestions, and receive and provide support from team members.

1.5 Improve the processing of feedback on SOC tools, technologies, data, and analytics to improve their effectiveness:

When SOC functions are separated or teams are geographically dispersed, the quality of interaction and information sharing may decrease. From SOC leaders, it is important to get business context, coordination, support, and give back technically accurate data, metrics, reporting, improvement ideas. Within the SOC, requirements, ideas, solutions should be shared, support should be obtained, and feedback should be continuously received and processed.

2. Interaction with stakeholders and customers

Engaging with customers, including senior management and IT executives, and being able to clearly articulate the SOC's objectives and needs will build a strong relationship between the SOC and its customers. Engaging at a lower level, with specific stakeholders, will enable the SOC to increase its understanding of the client company's operations and establish strong relationships. In this section, the authors of the publication cite various forms of engagement with customers, such as:

- Providing customers with information about the services provided by the SOC centre;

- Understanding business processes and communicating changes;

- Informing about cyber risks in terms of running the business and achieving objectives;

- Receiving and providing responses to incident reports;

- Providing insight into SOC architecture, tools, data, processes;

- Co-creating and customising detection and analytics methods, monitoring and responding to incidents;

- Receiving and processing feedback to improve performance;

- Training of customer representatives.

2.1 Provide customers with information about the services provided by the SOC Centre:

The SOC centre should be concerned about creating an information resource that provides the customer with information about what the SOC is and what it does. As the maturity level increases, the materials provided can cover the specifics of particular functions, describing large-scale incidents already handled by the SOC centre to raise the profile of the SOC in the eyes of customers. The information resource (this could be an internal web portal, Wiki page or SharePoint site) should include information on how and why the SOC protects customers, how customers support the SOC, how to contact the SOC in the event of a suspected cyber incident, what services the SOC provides, how the SOC provides customer awareness and training, and a list of the IAPs that support and authorise the SOC.

2.2 Understanding business processes and communicating changes:

As stated in Strategy #1, it is important for the SOC centre to know what it is protecting and why - this knowledge is gained by working with customers and will further enable the SOC centre's investments and business objectives to be aligned, resources and support to be obtained, and risk to be mitigated. Together with the customer's IS specialists, the SOC centre should regularly interact with respondent employees (executives, managers, line staff) to discuss IS investments and cybersecurity requirements, ongoing and completed IS projects, SOC successes and important cyber incidents in the respondent's area of responsibility, new cyber threats and IS risks. SOC team members during such discussions should also receive information about business changes that may affect the SOC (e.g. new business services, reorganisation of business structures), learn about respondents' perceptions of IS issues and cyber risks, receive feedback on the SOC centre's activities, plans, investments, and receive updates on changes in the IT/OT landscape, cloud and mobile infrastructures to update the inventory that the SOC uses. These meetings and information exchanges should complement, but not replace, regular data update procedures in the SOC. Such meetings in large companies may be held separately with each line of business, with a frequency of once a month or once a quarter.

2.3 Communicate cyber risks in terms of doing business and achieving objectives:

The SOC Centre and Red Team teams have a good and deep understanding of the customer company's cyber risks from a technical perspective, so it is important to communicate this information to customers in terms of the impact of the risks on the business and taking the necessary actions. The SOC can communicate information about cyber risks and related potential negative consequences in the form of regular alerts via email, website, briefings, metrics and reporting, providing information about cyber incidents and necessary post-incident actions, emergency notifications about vulnerabilities and the need to install updates (if vulnerability management is the responsibility of the SOC).

The authors of the publication provide the following recommendations on rules for informing customers, including sending vulnerability notifications:

- Prepare for notification in advance: develop a mailing template and plan the method of notification in advance, create a correct list of notification recipients (send information about vulnerabilities of specific systems not to the whole company, but only to the system owners), contact those responsible for the systems and for the installation of updates in advance to get their feedback, adjust remediation plans and send notifications, and think about the text of the notification (it should be relevant and contain a specific list of actions to be taken).

- Be concise and clear about what is required of the recipients: what needs to be done, with what assets, when and why, provide detailed instructions (download an update from this page, update this software, disable this component/service), and ensure that those who are actually responsible for the vulnerable system receive the notifications and instructions;

- Ensure the quality of notifications: document the process of generation and verification of the notification test and mailing, ensure the accuracy of technical details in the mailing (if the mailing contains the results of an analytical assessment, specify its level of confidence), and pay close attention to the grammar and formatting of the notification.

2.4 Receive and provide responses to incident reports:

The SOC centre should provide customers with a number of ways to report malicious or suspicious activity, e.g. via a form on the website, via email (choose a simple and easy to remember email), via technical support. These methods should be known to employees of the client company, and this information can be communicated at training sessions. It should also be ensured that notification of receipt of the message is sent to the customer's employees so that they know that the information has been received by the SOC centre and accepted for processing. When responding, the SOC Centre will ask the customer company's employees clarifying questions and details of the incident, so employees should be prepared for this and the SOC Centre should have the authority to do so.

2.5 Provide information about the SOC's architecture, tools, data, and processes:

To ensure customer confidence in the SOC centre, it is important to provide dosed information about SOC architecture, tools, data, processes in a controlled manner. In case of uncontrolled dissemination of this information, there is an increased likelihood that attackers will be able to obtain data about the types of SOCs and successfully bypass them, therefore all requests for any information about the SOC centre's operations should be carefully analysed and, if necessary, the information disclosed should be minimised. To increase the level of trust of the SOC-centre on the part of customers, it may be appropriate to provide general information about the technologies used and SOC architecture (without details in the form of IP-addresses, software versions and protection systems). Informing the customer's employees about the types of technologies used should increase their sense of responsibility for compliance with the company's IS rules, but not provide them with sufficient technical details that may facilitate circumvention of security measures.

2.6 Co-creation and customisation of detection and analytics methods, monitoring and incident response:

In the case of a SOC centre working with high-tech client companies, you may consider working more closely with representatives of the client company who are qualified to handle joint tasks. This synergy can help to better understand the context of the protected systems, integrate the customer's systems and networks into the SOC's cyber incident management process, and more correctly and quickly investigate and respond to incidents. To achieve this synergy, the SOC must have resources to interact with the customer's representatives, the SOC's technical capabilities must support such interaction, the customer's representatives must comply with SOC tools and SOC information handling procedures, the chain of escalation and notification of cyber incidents must not change, the order of response must be dictated by the SOC and strictly adhered to, and regular synchronisation and information exchange between participants must be ensured, and expectations of mutual cooperation must be met.

2.7 Obtaining and processing feedback to improve performance:

In addition to receiving regular feedback on incidents and communication with customer stakeholders, more structured and frequent feedback should be provided. This could take the form of a feedback form in the incident ticket (‘please evaluate how the SOC Centre has performed’), or periodic surveys of the customer's employees. It is also recommended that informal meetings be held with stakeholders to receive feedback and discuss ways to improve the SOC's performance.

2.8 Training of customer representatives:

The SOC centre plays an important role in improving the level of cyber security culture in the customer company. Together with representatives of the customer's IS department, information should be provided on malicious campaigns, new cyber threats, results and ‘lessons learnt’ from cyber incidents, and the experiences of other companies in the same sector. In cyber training sessions, the work and recommendations of the SOC centre should be communicated to the company's employees. It is also possible to give examples of successful performance by the SOC-centre of tasks on response to cyber incidents, detection of intruders, cyber threat analytics, which will help to increase the reputation of the SOC-centre.

3. Engagement with the IS community

No IS-professional in the world can know absolutely everything, so it is important to interact, learn, exchange information with representatives of other IS-companies, researchers and vendors in order to gain new knowledge, update expertise, exchange opinions on defence technologies and TTPs of attackers. In doing so, it is important to build relationships with representatives of the IS community in advance, i.e. before their assistance may be required at the critical moment of a major incident.

3.1 Information Sharing and Knowledge Gathering:

Participating in discussions and exchanges of experience on a variety of platforms will help the SOC centre to be more informed and flexible, to better understand attackers' TTPs, cyber threat analytics, and ways of working with technology. If the SOC receives information on such platforms that cannot be obtained in any other way, it indicates a successfully built model of interaction with the community. At the same time, large SOC centres may have dedicated resources for informing the community, and the information itself may be regular; small SOC centres may also have interesting information and should be able to share it with the community. To ensure that information is correctly shared outside the SOC centre or client company, a dissemination policy should be developed that complies with the legal and PR standards and internal rules of the client company. You should also ensure that rules are in place for SOC team members to discuss SOC activities publicly, there is a policy to vet content before publication, the company's legal, PR and IS executives oversee the process, and SOC team members have the ability and approval to conduct public activities.

Interaction is also possible between SOCs directly, including direct contact between analysts from different SOCs and each other. Such communication may begin when jointly responding to a common incident or when working with customers in the same sector of the economy. Later, such interactions can be formalised or remain informal - both are useful for sharing experience, knowledge, building loyalty and a sense of ownership among employees. It is also possible to interact on the basis of specially created platforms - forums, associations, working groups, including those formed with state participation, united on some grounds (geographical location, sector of economy served, types of technologies used).

3.2 Organisations work together to respond to incidents:

Often, some types of major cyber incidents can only be effectively resolved when SOC centres serving multiple companies affected by the incident work together. For example, in a cyber attack on a software/hardware vendor, there is a risk of the threat spreading to its customers, so the vendor's SOC centre would be better served by working together with its customers' SOC centres. When preparing to respond to incidents that may extend beyond the customer's infrastructure, the SOC centre should update the contact details of its counterparties, partners, service providers, equipment, software and security software, as well as the contact details of law enforcement agencies and SOC centres with which it has established cooperation.