A SOC that watches or a SOC that acts
Jul 10th, 2021 by Jesper Kråkhede
This one is a bit longer than usual, because it is a topic close to my heart after this spring.
There are two kinds of SOC. The first one watches. It collects logs, looks at alerts, and when something looks bad it writes a ticket or sends a mail to the customer: ‘We have detected suspicious activity on server X. Please investigate.’ Then it waits.
The second one acts. When it sees ransomware behaviour on a server, it isolates the server. When an account logs on from somewhere impossible, it disables the account and kills the sessions. Then it calls the customer and explains what it did.
The difference sounds small. In an incident it is everything. Modern ransomware groups can go from first access to encrypting the whole environment in a few days, sometimes less. In several of the incidents I have worked on this year, the SOC actually saw the attack. The alerts were there. But the mail was sent on a Friday evening, read on Monday morning, and by then it was too late.
Why don´t more SOCs act? Mostly because they are not allowed to. The contract doesn´t give them the mandate, the customer is afraid that they will shut down something important, or the SOC doesn´t have access to the tools that can isolate a machine or disable an account.
Those are fair worries, but they can be solved. Agree in advance which actions the SOC may take without asking: isolating a workstation, disabling a normal user account, blocking a known bad file. Agree which actions need a call first, like isolating a critical server or disabling an admin account. Write it down, test it and review it after every incident.
Make sure the SOC has the technical means. A modern EDR can isolate a machine with one click. The identity platform can revoke sessions and force a password reset. Automation can do the obvious things in seconds, so the analysts can spend their time on the hard ones.
And measure the right thing. Not how many alerts the SOC handled, but how long it took from detection to the threat being contained.
A SOC that only reports is a very expensive smoke detector without a sprinkler.
Give it the right to act.