SOC Performance Improves, But Remains Short of Optimum: Report

The good news is that security operations centers (SOCs) are becoming more efficient. The not-so-good news is that there is still considerable scope for improvement.

This is the conclusion of the fifth annual Micro Focus State of Security Operations Report for 2018 () which is currently scheduled to become enforceable in May of 2018. The consolidation and relocation of SOCs within the EMEA regions to form Security Fusion Centers have also improved the effectiveness of security operations."

North American SOCs showed only a limited improvement of 1%; but that follows a major improvement of 34% last -- and at 1.53, it remains ahead of the UK's 1.47. "Security operations teams in North America," says the report, "once again led as the region most willing to undergo external evaluations of their cyber defense capability and experienced accelerated results based on the implementation of targeted roadmaps."

Cloud migration has proven a problem for many SOCs. In most organizations, the cloud strategy focuses on application functionality without accounting for security and logging requirements. "Plans to monitor," notes the report, "did not follow key assets to the cloud for most security operations centers, leaving these SOCs with visibility only into the functionality that remained within legacy data center space."

In 2015, Micro Focus noted that organizations had begun to invest in big data lakes and analytics. By 2017, assessments showed that some SOCs are performing successful analytics, usually mining historical data for TTPs and IoCs -- but, "for the majority of organizations assessed such investments continue to be a science experiment with an uncertain future."

The use of deception grids continues to grow. The purpose is to increase the cost of an attack by tricking the attacker into deploying resources that are ineffective; while simultaneously learning about both the attacker and his intentions. Micro Focus expects this practice to grow, and will monitor the use of deception grids and their effect on SOC maturity in future years.

Overall, Micro Focus is optimistic over SOC progress in 2017, but warns that SOCs are no quick fix for security. "Successful security operations programs require an assessment of the risk management, security, and compliance objectives of the organization and the active tuning of the solutions deployed."

Related:  

Related: