For business, mindset trumps infrastructure when it comes to next-gen cybersecurity

Today’s enterprise organizations have never been more connected — with more devices, users and data to secure than ever. Meanwhile, the threat landscape is more complex, with each enterprise having to contend with its own challenges in ways that won’t slow down business. Any organization will at some point consider the need for a 24/7 security operations center, or SOC, to manage the daily deluge of security alerts — any of which could become significant incidents if not addressed effectively. But while every SOC contains a massive amount of hardware, software and processes, the most necessary component isn’t something you buy. It’s about a mindset.

What is a SOC, and why do organizations need them?

A security operations center is the central hub of a security program. This is where an organization keeps eyes on all activity possible 24 hours a day, every day.

{mosads}This highly secure location contains sometimes hundreds of workstations, where highly trained security analysts continuously watch for unusual activity. When a suspicious event is identified, analysts respond with measures to either stop a potential attack or prevent it from spreading to mission-critical systems. After the risk, has been mitigated, analysts delve into a detailed investigation, gathering findings to be used in future incidents as needed.

Other teams of security engineers work to maintain an organization’s security tools and optimize specialized computer code to help trigger alerts. In the most advanced SOC environments, teams of threat management professionals – essentially ethical hackers – continuously test defenses by trying to get inside undetected. And when they do, they report back to engineers and analysts so that the alerting mechanisms can be updated. And so on.

All of this is made possible by technology, but that’s not the most important part. The most important aspect of any effective SOC is its ability to adapt, to think critically, to be creative, and to communicate. None of that comes from a tool.

The mindset of a modern SOC

Some may think the answer lies in hiring the most talented people. In fact, one of the most commonly cited challenges of today’s security industry is an oft-publicized looming workforce shortage. That’s part of the issue, but it’s not the whole story.

Simply having more people in a room doesn’t ensure they’re willing to work together, to constructively question each other, to keep pushing boundaries of what a security program can do. It takes that kind of mindset to drive innovation and continual advancement in such a dynamic industry. This environment must be reinforced daily by SOC leaders and organizational partners. After all, the security world changes from moment-to-moment. The SOC must to be the place always prepared for what’s next.

Customize wherever possible

No organization operates in the same way, and no organization has the same security risks. Simply using effective tools won’t necessarily beget an effective SOC. Much like with people, it takes a mindset that’s geared toward change. This means that everywhere possible, SOC leaders and team members should seek out ways to make their tools and processes truly their own.

This requires customizing alert logic, starting first from the business’s needs and most critical assets and working backwards. This takes a more intensive focus, but in the end, paves the way for more seamless monitoring and faster responses to incidents.

Explore automated and orchestrated solutions

With so much energy dedicated toward high-level customizations, it’s imperative that a next-gen SOC team identify other day-to-day tasks that can be automated and/or orchestrated. Next-gen SOC professionals should focus higher-level thinking skills on activities that add the most value, like performing thorough analysis of complicated cyber events or devising creative new ways to test an organization’s potential vulnerabilities. This includes everything from enriching alerts and technologies with vetted threat intelligence, all the way to creating scripts to automatically act on a known threat to automate well-defined play. This also includes setting up systems to automatically generate comprehensive reports for other teams or executives.

Don’t go it alone

When it comes to cybersecurity, the right mindset is everything. And it’s not something that happens overnight. The right mindset — which drives innovations, customizations and continual automations — has to be nurtured on an ongoing basis. It takes continuous training on new skills and best practices, constantly staying up on new threats, and staying engaged with what’s happening inside the enterprise organization. This requires a significant investment of time and energy. Couple that with resources it takes to install the needed hardware, software, and security infrastructure for a next-gen SOC, and it’s not surprising that more and more organizations opt not to build their own SOC from scratch, but instead find a service provider that already has the foundation in place to bring their security operations into the next generation.

Colin O’Connor is vice president of security operations for ReliaQuest, a leading IT security services provider for large enterprises.

The views expressed by contributors are their own and are not the views of The Hill.