The next generation of SOC: a future-ready solution

The decentralisation of organizations and the software they use has expanded the attack surface to a point where most security operations centres (SOC) struggle to keep up with the volume of data required to monitor and protect these systems.

A decade ago, the SOC collected, stored and processed alerts in a single location. However, since then, organizations have changed how they purchase software, IT services, and hardware. This decentralisation has resulted in individual business units and functions having to take control and ownership of larger, more significant volumes of data and, where this isn’t possible, having to surrender certain application controls and oversight to external providers, notably hyperscale cloud providers.

My organization, Adarma, a leading managed SOC provider, recently released a report titled ‘How to Design a Future-Ready SOC’, in which we propose a new reference architecture for remaining adaptable and agile in the face of ongoing change. This change could pertain to the threat landscape, technology environment, or the circumstances of the business the SOC endeavours to protect. The concept of a future-ready SOC aims to overcome many of the issues that traditional SOCs currently face. For many organizations, the current manual process and resource-heavy approach along with monitoring multiple vendor technologies has resulted in observability gaps, tool overlap, exploding volumes of data, and difficulty hiring and retaining skilled staff.

How does the future-ready SOC work?

The future-ready SOC is distinguished by its open and extensible architecture, allowing internally developed capabilities to sit alongside leading vendor technologies without any historical issues with lock-in. This enables an organization to benefit from collaboration across in-house capabilities and trusted partners. A future-ready SOC works by implementing the following:

Open architecture

Open architecture allows an organization’s in-house capabilities to coexist and collaborate with priority vendor technologies, enabling better innovation and adaptability. The architecture should also be extensible, reducing dependency on a single vendor and facilitating the adoption of new technologies.

Data acquisition and storage

For a future-ready SOC to be effective, it needs to be able to gather, process, and store relevant data from various sources and use it to enhance security. There are two key aspects to data gathering in a future-ready SOC:

An organization’s ability to recognise the value of different types of data in a security context.
The ability to efficiently and cost-effectively extract, route, and store this data. By prioritising data, the SOC can send it where it’s most useful, and store it in the right place and format to maximise cost efficiency. Data pipelining technology is a new approach that can help achieve this, while also reducing data intake and storage expenses.

Federated detection and response

Within a future-ready SOC, detection and response should be orchestrated to minimise the time to respond and to maximise the effectiveness of a response. The primary objective of a federated detection and response model is to enable quick recovery of information from a distributed enterprise environment. The local SOC must then use its own detection and response capabilities and storage to improve mean time to detect (MTTD) and meantime to respond (MTTR) without running up data transfer costs. A federated approach should heavily rely on centrally orchestrating detection logic and intervention techniques.

Continuous Posture Assessment

Continuous posture assessment (CPA) aims to combine the data outputs of vulnerability management, attack surface management, and breach and attack simulation. In a future-ready SOC architecture, posture assessment must be continual and sustained. The information provided from these combined assessments allows organizations to understand critical assets, the expanse of relevant IT environments, and the overall security posture of an organization. CPA should catch and provide the real-time data used to inform an organization of how best to interact with assets, remediate issues, and reduce waste all in consideration of the ultimate goal: cyber resilience.

Machine learning and artificial intelligence

Considering analyst fatigue is a real concern within the traditional SOC model, it is important for the next generation of SOCs, like most cybersecurity solutions, to embrace machine learning (ML) and artificial intelligence (AI) as an aid. By using this growing technology to cut through the noise, analysts can focus on more unique or significant concerns.

By carefully experimenting, organizations that purposefully adopt technology like ML and AI can use these tools as a first line of defence. With AI trained to flag any baseline deviations in behaviour, organizations can then focus on the more significant, higher-level concerns. Security professionals believe that AI and ML will greatly benefit cybersecurity. Indeed, an Adarma survey of 500 security leaders from last year found that over half of the respondents believed AI could theoretically effectively manage up to 30% of security operations.

Ready to take the leap?

A future-ready SOC is a comprehensive solution that enhances visibility across all the environments under monitoring. Companies opting for this approach will not only experience improved security and teamwork but also ongoing adjustments to stay ahead of threats. A future-ready SOC truly represents the next generation. However, organizations looking into this path must first assess the status of their current SOC.

Before transitioning to a future-ready SOC, businesses should ask themselves the following questions:

Does your organization understand its security posture against emerging threats?
Can your organization adapt its threat response as business priorities and functions change with time?
Does your organization have the in-house capabilities to maximise and manage security investments?
Can your organization prioritise against the exponentially increasing vulnerabilities affecting enterprise environments?
Does your organization have a broad, easy-access view of all exposures, vulnerabilities, misconfigurations, and threats that are impacting operations or may do so in the future?
Can your organization communicate the value of its security operations to leadership?

By asking these questions, organizations can advance into the next generation of SOC with a clear understanding of their current standing. Given the rapid changes in data and asset security methodologies over the past decade, these requirements are likely to keep evolving in the coming years. This emphasises the increasing importance of establishing security operations in a flexible and agile manner, enabling adaptation, evolution, and ultimately, improved cyber resilience.