Modernising SecOps: It’s Time To Unpick The Complex Matrix

Urgent solutions to support remote and distributed workforces have fuelled transformation across the business world. In response, hackers have also upped their capabilities. 

Today, the hackers’ bag of tricks is increasingly targeted and complex, meaning awareness, vigilance, and education are vital weapons and our most critical line of defence. Every day 450,000 new pieces of malware are detected, and 3.4 billion phishing emails hit inboxes. Nearly half of organisations responding to SANS Institute's latest survey listed malware such as ransomware as a significant concern. 

Just as organisations embrace modern working and next-generation technologies, security operations must modernise, going beyond responsive defence to build in resilience through proactive protection. Modern SecOps leverages personnel, processes, and tools to promote measurable results in securing infrastructure and business processes. 

Our latest research breaks down the core priorities for today’s SecOps modernisation. In a world where cyber criminals are capitalising on business growth and ever-changing business patterns, it's time to stop hackers dead in their tracks by benchmarking SecOps status and taking proactive steps to transform it. Spanning the fundamentals of people, process, and technology, a new approach that tackles the obstacles and builds a shared framework to ensure business resilience is mission critical.  

The Perennial People Problem

61% of businesses say that staffing and workforce are their primary SecOps concern. The human factor is an ongoing challenge for SecOps, but there exists a duality. On the one hand, people have become the primary attack vector for cyber attackers; humans rather than technology now represent the most significant risk to organisations. 

To effectively manage human risk, people are also the solution. For example, security awareness professionals are vital in managing workforce education - the most mature security awareness programmes have the largest number of people dedicated to managing and supporting it. 

However, the similarly well-recognised cyber security skills crisis still rages. 62% of organisations struggle with staffing cyber roles. There are myriad reasons why this challenge persists. Data growth, technological changes, and compliance requirements make maintaining adequate cyber talent and resourcing challenging due to the complexity and cost of maintaining these capabilities. 

Retention complicates this dynamic. Where talent exists, 64% report SecOps personnel are professionals with five years or less experience. Cyber professionals will often endure the strain of SecOps work at the start of their careers, but most do not want that to define their career long-term. 

In response, many organisations are increasingly outsourcing cyber functions to distributed global and managed security service providers. However, security orchestration, automation, and response (SOAR) tools have also become standard, deployed in many security operations centres to increase the efficacy of existing staff. 

Automation Meets The Human Factor

A SecOps analyst must detect and respond to a high-severity incident within an hour. 

Staff shortages impact response times, yet the expectations of organisations to remedy issues remain high. We asked organisations what the average mean downtime they would be willing to accept during a high-severity incident, such as a ransomware attack. Nearly a quarter said they would tolerate six hours, 20% reported 24 hours, and 13% reported one hour. Stakeholder expectations of downtime don’t align with resourcing commitments. 

With this in mind, security orchestration, automation, and response (SOAR) tools that quicken response times and ensure greater accuracy can be considered part of any SecOps modernisation strategy.

The rapid evolution of technology produces more signals for a cyber analyst to evaluate, driving requirements for automation. SOAR tools help human analysts do vital SecOps work quickly and effectively by automating routine actions, resulting in fewer mistakes, while orchestration among many systems provides efficiency. Such tools empower SecOps professionals to make decisions confidently while empowering the organisation to implement limits on what any individual can do. This maintains separation of duties within compliance, policy, and legal constraints to minimise the likelihood of system damage and legal liability.

However, while SOAR is complementary to SecOps functions, it is not a silver bullet for staffing shortages. Organisations told us that incident response (34%) and automation (15%) are listed as the greatest SecOps strengths, although 30% of respondents also noted automation as one of their SecOps programme’s most significant weaknesses. These findings indicate that SOAR can increase the efficacy of existing staff but can’t replace staffing entirely.

Artificial intelligence and machine learning can boost analytical procedures and help humans scale their analytical functions but cannot replace human talent. A modern SecOps strategy will appreciate this delicate balance and weigh investment in recruitment and retention alongside essential tools and technologies. 

Realising SecOps Modernity 

There is a desperate need to mature SecOps programmes. Cyber staffing shortages are the overarching challenge - the SecOps industry cannot secure data with the available workforce, and SOAR is not a cure-all. 

 Modernisation through technology is a vital part of the modernisation matrix. Still, it is clear that much more needs to be done to close gaps in knowledge, skills, awareness, and compliance - this can be seen as the bedrock of the cyber security process. As such, knowledge is the foundation of any modernisation effort. Only once people, processes and technology are equally matched will modernisation come to fruition. 

John Davis is UK & Ireland Director at SANS Institute  

You Might Also Read:

The Cyber Delusion Challenge For Small & Medium Businesses:

 

« Lessons From The Cyber Front Line
Pivoting Customers' Mindsets For Cloud Security »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Seceon

Seceon

Seceon OTM, is a cyber security advanced threat management platform that visualizes, detects, and eliminates threats in real time.

Dcoya

Dcoya

Dcoya's complete security awareness training program gives you out-of-the-box compliance with PCI-DSS, HIPAA, SOX and ISO regulations.

Digital Guardian

Digital Guardian

Digital Guardian is a next generation data protection platform designed to stop data theft.

Privacy Analytics

Privacy Analytics

Privacy Analytics enables healthcare organizations to unleash the value of sensitive data for secondary purposes without compromising personal health information.

ThreatSpike Labs

ThreatSpike Labs

ThreatSpike Labs provides the first end-to-end fully managed security service for companies of all sizes.

Bugraptors

Bugraptors

BugRaptors is a certified software testing company with extensive experience as a third-party testing vendor, effectively proven as a leader in software testing & QA Services.

SyferLock Technology Corp.

SyferLock Technology Corp.

SyferLock is an innovative provider of next-generation authentication and security solutions.

LTIMindtree

LTIMindtree

LTIMindtree is a new kind of technology consulting firm. We help businesses transform – from core to experience – to thrive in the marketplace of the future.

Wisetek

Wisetek

Wisetek is a global provider of end-to-end IT Asset Disposition (ITAD), reuse and secure data destruction management services to the world’s leading IT Corporations, data centres and manufacturers.

CloudCover

CloudCover

CloudCover is a software-defined cybersecurity risk solution that provides risk awareness, risk analytics, and data security in real time.

Advantage

Advantage

Advantage exists to provide peace of mind in an evolving technology reliant world. We were created by visionaries who for nearly 4-decades have been passionate about providing world-class solutions.

Avanade

Avanade

Avanade is a leading provider of innovative digital, cloud and advisory services, industry solutions and design-led experiences across the Microsoft ecosystem.

Tenchi Security

Tenchi Security

Tenchi Security are specialized in Third-Party Cyber Risk Management (TPCRM) and aim to reduce information asymmetry when it comes to third and Nth-Party security and compliance risk management.

Automotive Information Sharing & Analysis Center (Auto-ISAC)

Automotive Information Sharing & Analysis Center (Auto-ISAC)

Auto-ISAC provides a forum for companies to analyze and identify threats sooner and share solutions that enhance vehicle cybersecurity.

Synergy ECP

Synergy ECP

Synergy ECP has a talented, dedicated staff to provide a broad range of services to the defense and intelligence industries.

CPX

CPX

At CPX, we go beyond addressing today’s security risks—we anticipate the challenges of tomorrow.