What’s Next? Areas for Innovation in Your SOC

This chapter will outline key areas that can take a SOC from basic to mature, covering topics such as scalability and automation. In this chapter, I will share my ideas for innovating my SOC, as well as insights from interviews with other industry professionals about what they believe needs to be done to promote innovation. The chapter will cover the following:

• Automation is the way
• Scaling to the future
• Helping hands – thoughts from industry professionals

Technical requirements

For this specific chapter, there are no installations or specific technologies that are required.

Automation is the way

As mentioned in other chapters, every team should be looking to automate as much as possible. Doing so will allow your team to increase their coverage and the number of alerts that can be triaged. In some of the previous examples, we’ve discussed using a Search Orchestration Automation and Response (SOAR) tool, which automates triage and response actions. These are tools such as Splunk Phantom and Insight Connect. They allow you to customize actions such as gathering information, quarantining systems, or implementing blocks. One of the issues is that not all teams and organizations have the money to purchase SOAR tools, so they must look to other options for automation.

One option if you have a coding background is to create your own scripts to automate different features. One example is when an old team member created a Python script that took the nightly vulnerability data, created JIRA tickets for the new vulnerabilities, and captured mean time to...

Scaling to the future

Scaling as a team is a concept that has always been around, but has been the primary focus of only senior-level leaders. In my experience, I’ve seen a shift in the past few years, and more mid-level leaders and individual stakeholders have been involved in scaling and roadmap planning. I’ve also, fortunately, had the experience of building multiple teams from the ground up. When creating the team, we established team norms, a vision and mission, and a charter so we understood the role of the team. When it came time to scale after making the initial hires, I loosely followed these steps:

• Evaluated the capabilities of the team members
• Projected out hiring for expanded operations and coverage and created an operations model
• Ensured there was cross-team collaboration in place, including policies and procedures
• Started an employee development and learning plan
• Filled our cybersecurity tool gaps

For the first step, Evaluated...

Helping hands – thoughts from industry professionals

The security industry is surprisingly small, or at least it feels that way sometimes. It can also be incredibly welcoming to those looking to learn and insightful about what they believe the future will look like. I asked multiple different industry professionals what they believed the future of SOC environments would be, and their thoughts varied.

Ryan Franklin, the security manager of threat-hunting for Amazon in 2023, believes the following:

“One of the biggest challenges security teams face today is simply the reactive nature of our business. Nearly every team focuses heavily on detection and analysis, but detection and analysis do nothing to actually stop an attack. In many cases, ransomware actors are able to compromise an entire domain in a matter of hours. That leaves a very small window for our SOCs and SIRTs to take action, and that’s exacerbated by other factors, such as visibility, coverage...

Summary

The SOC team and environment aren’t going anywhere, but they might look different in the future. I believe alignment with frameworks such as MITRE will be key moving forward to provide standardization, which will help teams become scalable. Additionally, it was a key theme that AI/ML and automation will both be important in growing your environments. If nothing else, please take away that you should be looking for opportunities to grow and optimize your environment, and never be afraid to reach out to the greater information security community for help.