MITRE publication ‘11 Strategies for a World Class SOC Centre’. Introduction (Strategy #0)

Ruslan Rakhmetov, Security Vision

MITRE is a non-profit organisation founded in 1958 at the MIT Research Laboratory. Currently, MITRE is working in various areas, the best known of which is cybersecurity, including such projects as MITRE ATT&CK, CAPEC, CWE, CVE, STIX, MAEC. MITRE's joint work with various SOC centres, commercial organisations, research and development centres served as a basis for the development of methodology and best practices for SOC centre management, which were presented in 2014 in the publication ‘Ten Strategies of a World-Class Cybersecurity Operations Centre’. The publication received a lot of publicity, and the feedback received and the changing cyber landscape prompted an update in March 2022, now called ‘11 Strategies of a World-Class SOC Centre’. The authors of the publication are three individuals with rich and varied IS experience, while emphasising that the writing has made extensive use of third-party material, a list of which is provided in Appendix ‘A’ of the book.

The publication is intended not only for SOC staff directly, but also for anyone who interacts with cyber incident handling (including IS department staff, system administrators, cyber risk and compliance officers). The publication offers guidance and practical techniques outlined in 11 strategies to help professionals improve their proactive and reactive search, analysis, response to cyber threats.

The book's recommendations are based on the experience of mature SOCs and provide suggestions for SOC architectures, tools, and processes, offer rationales for allocating resources to SOCs, describe methods for maximising the benefits of investments in SOC people and technology, and point to external conditions that can impact SOC success. The new edition examines cyber incident management in a variety of environments, including cloud, mobile, OT infrastructures, while focusing on popular cybersecurity technologies such as SIEM, TIP, EDR, UEBA, SOAR, big data, machine learning, attack and hacking simulations.

The publication ‘11 Strategies for a World-Class SOC Centre’ begins with an introductory part, which the authors have tentatively labelled ‘Strategy #0’: it contains basic concepts and principles of SOC operation, defines important terms, and describes the technologies used in SOC. This post is devoted to the review of this introductory strategy.

So, in Strategy #0, the authors of the book list some of the reasons for the recent rise in popularity of SOCs (despite the fact that the first SOC centres appeared back in the 1990s):

- The rise of APT attacks and the evolution of the tactics, techniques and procedures (hereafter referred to as TTPs: Tactics, Techniques and Procedures) of attackers

- digital transformation of businesses, digitalisation of most processes;

- blurring of the traditional network perimeter, coupled with a massive shift to remote working due to the pandemic

- proliferation and integration of SCADA systems, automated control systems, OT infrastructure elements

- Increased information coverage of cybersecurity issues, up to discussion at the level of the world's leading media outlets

- realisation of the importance of cyber security by CEOs around the world and the inclusion of cyber risks in the overall risk management structure of many companies.

The publication also defines a SOC (Security Operations Center) as a team of predominantly cybersecurity professionals formed to prevent, detect, analyse, respond to and report cybersecurity incidents. The main task of a SOC is cyber defence of its clients/customers, which implies protection against unauthorised actions in cyberspace, including monitoring, detection, analysis, response, recovery from cyber incidents. Customers can be external (in case of commercial SOCs) or internal (in case SOCs are included in the organisational structure of a company), which use the services of SOCs to search, analyse, respond to cyber intrusions, and SOCs can be different in structure, functionality, number, resources, and can be named differently. For example, foreign countries use such terms as Computer Security Incident Response Team (CSIRT), Computer Incident Response Team (CIRT), Computer Incident Response Centre (CIRC). In addition, the term Computer Emergency Response Team (CERT), which is a registered trademark of Carnegie Mellon University and was first used in 1988 during the Morris Worm outbreak, is also found in the literature.

SOC protection targets include users, sites, IT/OT/cloud assets, data, networks, organisations, and elements of customers' IT infrastructure (on-prem and remote), cloud, mobile, OT infrastructure. The mission of a typical mid-sized SOC may be to perform the following tasks:

- Preventing cyber incidents through proactive measures such as continuous threat monitoring, finding vulnerabilities, applying countermeasures, advising customers on IS policies and IS architecture

- Monitor, detect, analyse potential cyber intrusions in real time and by searching for attacker footprints using relevant data sources

- Respond to confirmed incidents through coordinated resource allocation and the application of rapid and relevant countermeasures

- Providing customers with situational awareness and reporting on cyber security status, IS incidents, cyber attack trendsSOC technology setup and operation (configuring data sources from devices and networks, collecting security events, managing analytics systems).

The document also defines some of the terms used in SOC operations:

- Event is a recorded situation on a system and/or network;

- An Alert is a notification of the occurrence of a specific event or series of events;

- Cyber Incident is an action performed using an information system or network that resulted in an actual or potential negative impact on the information system, network and/or the information processed therein;

- Triage is the process of sorting, categorising and prioritising incoming events and other requests to SOC resources.

SOC functions depend on the maturity of the SOC, customer objectives and the scale of protected objects and resources allocated.

The functional categories and areas of SOC activities are divided in the publication as follows:

1. triage, analyse, respond to cyber incidents:

1.1. Real-time monitoring and triage of alerts

1.2 Receiving incident reports from customers, from other SOCs, from third parties in written or verbal form

1.3 Analyse and investigate incidents, including determining the source, scope and impact of the incident, with an indication of the degree of confidence in the conclusions formed

1.4 Containment, remediation, recovery to reduce the current negative impact of the incident and prevent reoccurrence of incidents

1.5 Coordinate incident response activities by gathering and communicating information, managing and coordinating efforts with customers, responders, other SOC, third parties

1.6. Forensic analysis of incident artefacts to obtain detailed information about the incident, analyse media content, build an incident timeline

1.7 Analyse VPOs to obtain information on the origin, functionality, purpose of the VPOs used

1.8 Respond to incident with on-site visit to the customer 1.8.

2. Cyber threat data management, search and analysis of cyber threats:

2.1 Collecting, processing, enriching cyber threat data through TIPs, TI feeds and cyber threat reports, processing and integrating cyber threat data into SOC systems

2.2 Analysis and generation of cyber threat intelligence to track attackers, correlate and identify trends in their behaviour, then support risk-based decision-making by generating reports on attackers, their TTPs, malicious campaigns

2.3 Disseminate and provide access to cyber threat data to partners, other SOCs, and the IS community 2.4.

2.4 Search for cyber threats (Threat Hunting) by performing proactive actions to detect potentially malicious activity based on the assumption that attackers are already in the infrastructure or are currently conducting an attack

2.5 Configure sensors and analytics, including maintenance and optimisation of detection, analytics, signatures, correlation and response rules in SOC systems, including EDR, SIEM, SOAR solutions

2.6 Creation of customised cyber-attack analysis and detection tools based on knowledge of attacker TTPs and customer infrastructure

2.7. Data Science and machine learning to support SOC functions.

3. Advanced SOC functions:

3.1 Cyber attack emulation and audits including red and purple teaming, penetration testing, emulation of attacker actions, attacks and hacks to enhance SOC effectiveness and defence capabilities

3.2 Deceive and confuse attackers to conceal the structure of networks and assets, misdirecting hackers 3.3.

3.3 Combat insiders by identifying, analysing, investigating malicious or anomalous activity of legitimate users.

4. Vulnerability Management:

4.1 Inventory assets by gathering and maintaining a knowledge base of customer assets, networks and services, building their relationships, calculating asset criticality and risk levels

4.2 Scan assets for vulnerabilities, obtaining information on asset configurations, vulnerability status, installed software and updates to calculate the cyber risk and compliance status of assets

4.3 Vulnerability analysis by systematically examining information systems or software products to assess the adequacy of applied protective measures, identify security flaws, evaluate the effectiveness of proposed countermeasures, and confirm their correct implementation

4.4 Receive and analyse vulnerability reports from researchers in order to apply appropriate compensatory measures 4.5.

4.5 Search, research, analyse previously unknown vulnerabilities by processing incidents, collecting data on cyber threats, reverse-engineering with further transfer of the obtained information to other SOCs, vendors, customers

4.6 Installing security updates, reducing the risk of vulnerability exploitation.

5. Tools, architecture, SOC engineering:

5.1 Create architecture for SOC monitoring, analytics, operational environment, including integration of different solutions and components, and assessing the feasibility of different products

5.2 Deploy, configure, support, operate network defences, including establishment and support of network connectivity and data transfer between solutions

5.3 Deploy, configure, support, operate host-based defences, including establishing and maintaining network connectivity and data transfer between solutions 5.4.

5.4 Deploy, configure, support, operate cloud-based defences, including establishing and maintaining network connectivity and data transfer between solutions 5.5 Deploy, configure, support, operate cloud-based defences, including establishing and maintaining network connectivity and data transfer between solutions

5.5 Deploy, configure, support, operate mobile security tools, including establishing and maintaining network connections and data transfer between solutions 5.6.

5.6 Deploy, configure, support, operate security tools for OT infrastructure, including establishing and maintaining network connections and data transfer between solutions 5.7.

5.7 Deploy, configure, support, operate analytics platforms (such as SIEM, SOAR, TIP, UEBA, big data analytics solutions), including establishing and maintaining network connectivity and data transfer between solutions 5.8 Deploy, configure, support, operate analytics platforms (such as SIEM, SOAR, TIP, UEBA, big data analytics solutions), including establishing and maintaining network connectivity and data transfer between solutions

5.8 Deploy, configure, support, operate SOC operating environment elements such as test environments, servers, workstations, printers, file shares and SOC networking equipment 5.9.

5.9 Create customised tools and systems to perform SOC tasks when suitable off-the-shelf solutions are not available 5.9.

6. Situational awareness, interaction, training:

6.1 Provide situational awareness of the customer's cyber security posture by communicating assets, risks, cyber threats, incidents, vulnerabilities to the customer to improve the customer's cyber security posture; interact with customers and external organisations to share information and work together

6.2 Conducting internal training and education for SOC employees to improve their professional level

6.3 Conduct external education and training for the customer's employees to raise their awareness of cyber security issues 6.3.

6.4 Conduct cyber training and drills to prepare for responding to cyber incidents 6.4.

7. SOC governance and management:

7.1 Manage SOC operations for day-to-day tasks, including financial and personnel management

7.2 Plan activities, develop strategy, and improve internal SOC processes by analysing ‘lessons learned’, assessing current status, and identifying new opportunities for SOC development

7.3 Ensure continuity of SOC operations by creating and evaluating plans to maintain SOC business processes during and after disruptions

7.4 Develop, measure, and report on metrics (indicators) of the effectiveness of operational processes, SOC performance, and the state of situational awareness of the customer.

In Strategy #0, the authors also highlight several important common theses for effective SOC operations:

1. The importance of gradually increasing the SOC maturity level from issuing recommendations, contextualising and enriching incident data to automating cyber incident response

2. The need for widespread use of SOC automation tools from the earliest stages of a cyberattack, emphasising that automation tools cannot currently fully replace the skilled analyst who makes the final decision. 3.

3. the ability to detect a cyberattack before attackers penetrate the infrastructure (left of hack) and to deter attackers once they are entrenched in the attacked network (right of hack).

4. effective detection and response to IS incidents depends on the SOC's ability to cover all stages of the cyberattack lifecycle, coupled with an understanding of the attacker's TTPs at each stage.

5. The importance of the speed of SOC personnel, processes, technology and deep understanding of the customer's infrastructure to stay ahead of attackers during a cyberattack by being proactive and reactive.