• Chief Information Officer (CIO)
• Chief Information Security Officer (CISO)
• Chief Operating Officer (COO)
• Security / IT Management
• Security Operations Director / Security Operations Center (SOC)
• Network Operations Director / Network Operations Center (NOC)
• Systems Administrator
• Threat Intelligence Staff
• Security Operations Staff
• Security Incident Responders
• Vulnerability Management Staff
• Patch Management

• Enhance your security program by implementing and streamlining next-generation security operations processes.
• Increase organizational situational awareness through active collaboration between core threat teams, enriching internal security events with external threat intelligence and enhancing security controls.
• Develop a comprehensive threat analysis and dissemination process: align people, process, and technology to scale security to threats.
• Identify the appropriate technological and infrastructure-based sourcing decisions.
• Design a step-by-step security operations implementation process.
• Pursue continuous improvement: build a measurement program that actively evaluates program effectiveness.

• Board / Chief Executive Officer
• Information Owners (Business Directors/VP)
• Security Governance and Risk Management
• Fraud Operations
• Human Resources
• Legal and Public Relations

• Aid decision making by staying abreast of cyberthreats that could impact the business.
• Increase visibility into the organization’s threat landscape to identify likely targets or identify exposed vulnerabilities.
• Ensure the business is compliant with regularity, legal, and/or compliance requirements.
• Understand the value and return on investment of security operations offerings.

Average data breach costs per compromised record hit an all-time high of $217 (in 2015); $74 is direct cost (e.g. legal fees, technology investment) and $143 is indirect cost (e.g. abnormal customer churn). (Source: Ponemon Institute, “2015 Cost of Data Breach Study: United States”)

“Empower a few administrators with the best information to enable fast, automated responses.”
– Ismael Valenzuela, IR/Forensics Technical Practice Manager, Foundstone® Services, Intel Security)

Insufficient security personnel resourcing has been identified as the most prevalent challenge in security operations…

When an emergency security incident strikes, weak collaboration and poor coordination among critical business functions will magnify inefficiencies in the incident response (IR) process, impacting the organization’s ability to minimize damage and downtime.

The solution: optimize your SOC. Info-Tech has seen SOCs with five analysts outperform SOCs with 25 analysts through tools and process optimization.

Sources:
Ponemon. "2016 State of Cybersecurity in Small & Medium-Sized Businesses (SMB).”
Syngress. Designing and Building a Security Operations Center.

Security operations is part of what Info-Tech calls a threat collaboration environment, where members must actively collaborate to address cyberthreats affecting the organization’s brand, business operations, and technology infrastructure on a daily basis.

Design and Implement a Vulnerability Management Program

• Vulnerability Tracking Tool
• Vulnerability Scanning Tool RFP Template
• Penetration Test RFP Template
• Vulnerability Mitigation Process Template

Integrate Threat Intelligence Into Your Security Operations

• Maturity Assessment Tool
• Threat Intelligence RACI Tool
• Management Plan Template
• Threat Intelligence Policy Template
• Alert Template
• Alert and Briefing Cadence Schedule

Develop Foundational Security Operations Processes

• Maturity Assessment Tool
• Event Prioritization Tool
• Efficiency Calculator
• SecOps Policy Template
• In-House vs. Outsourcing Decision-Making Tool
• SecOps RACI Tool
• TCO & ROI Comparison Calculator

Develop and Implement a Security Incident Management Program

• Incident Management Policy
• Maturity Assessment Tool
• Incident Management RACI Tool
• Incident Management Plan
• Incident Runbook Prioritization Tool
• Various Incident Management Runbooks

Phase 01

Phase 02

Phase 3a

Phase 3b

Effective security operations management will help you do the following:

• Improve efficacy
  Develop structured processes to automate activities and increase process consistency across the security program. Expose operational weak points and transition teams from firefighting to an innovator role.
• Improve threat protection
  Enhance network controls through the hardening of perimeter defenses, an intelligence-driven analysis process, and a streamlined incident remediation process.
• Improve visibility and information sharing
  Promote both internal and external information sharing to enable good decision making.
• Create and clarify accountability and responsibility
  Security operations management practices will set a clear level of accountability throughout the security program and ensure role responsibility for all tasks and processes involved in service delivery.
• Control security costs
  Security operations management is concerned with delivering promised services in the most efficient way possible. Good security operations management practices will provide insight into current costs across the organization and present opportunities for cost savings.
• Identify opportunities for continuous improvement
  Increased visibility into current performance levels and the ability to accurately identify opportunities for continuous improvement.

Impact

Short term:

• Streamlined security operations program development process.
• Completed comprehensive list of operational gaps and initiatives.
• Formalized and structured implementation process.
• Standardized operational use cases that predefine necessary operational protocol.

Long term:

• Enhanced visibility into immediate threat environment.
• Improved effectiveness of internal defensive controls.
• Increased operational collaboration between prevention, detection, analysis, and response efforts.
• Enhanced security pressure posture.
• Improved communication with executives about relevant security risks to the business.

1. Incident response cost:
   • Remediation costs
   • Productivity: (number of employees impacted) × (hours out) × (burdened hourly rate)
   • Extra professional services
   • Equipment rental, travel expenses, etc.
   • Compliance fine
   • Cost of notifying clients
2. Revenue loss: direct loss, the impact of permanent loss of data, lost future revenues
3. Financial performance: credit rating, stock price
   Hidden cost:
   • Reputation, customer loyalty, etc.

• Kick-off and introductions.
• High-level overview of weekly activities and outcomes.
• Activity: Define workshop objectives and current state of knowledge.
• Understand the threat collaboration environment.
• Understand the benefits of an optimized security operations.
• Activity: Review preliminary maturity level.
• Activity: Assess current people, processes, and technology capabilities.
• Activity: Assess workflow capabilities.

• Activity: Begin deep-dive into maturity assessment tool.
• Discuss strategies to enhance the analysis process (ticketing, automation, visualization, use cases, etc.).

• Activity: Design ideal target state.
• Activity: Identify security gaps.
• Build initiatives to bridge the gaps.
• Activity: Estimate the resources needed.
• Activity: Prioritize gap initiatives.
• Activity: Develop dashboarding and visualization metrics.
• Activity: Plan for a transition with the security roadmap and action plan.
• Activity: Define and assign tier 1, 2 & 3 SOC roles and responsibilities.

• Activity: Assign roles and responsibilities for each security operations initiative.
• Activity: Develop a comprehensive measurement program.
• Activity: Develop specific runbooks for your top-priority incidents (e.g. ransomware).
  • Detect the incident.
  • Analyze the incident.
  • Contain the incident.
  • Eradicate the root cause.
  • Recover from the incident.
  • Conduct post-incident analysis and communication.
• Activity:Conduct attack campaign simulation.

• Finalize main deliverables.
• Schedule feedback call.

1. Security Operations Maturity Assessment Tool

1. Target State and Gap Analysis (Security Operations Maturity Assessment Tool)

1. Security Operations Role & Process Design
2. Security Operations RACI Chart
3. Security Operations Metrics Summary
4. Security Operations Phishing Process Runbook
5. Attack Campaign Simulation PowerPoint

All Final Deliverables

1

2

3

Discussion: Why are we pursuing this project?

What are the objectives for optimizing and developing sound security operations?

Stakeholders Required:

• Key business executives
• IT leaders
• Security operations team members

Resources Required

• Sticky notes
• Whiteboard
• Dry-erase markers

1. Briefly define the scope of security operations
   What people, processes, and technology fall within the security operations umbrella?
2. Brainstorm the implications of not acting
   What does the status quo have in store? What are the potential risks?
3. Define the goals of the project
   Clarify from the outset: what exactly do you want to accomplish from this project?
4. Prioritize all brainstormed goals
   Classify the goals based on relevant prioritization criteria, e.g. urgency, impact, cost.

• Real-time monitoring, detecting, and triaging of data from both internal and external sources.
• In-depth analysis of indicators and incidents, leveraging malware analysis, correlation and rule tweaking, and forensics and eDiscovery techniques.
• Network/host scanning and vulnerability patch management.
• Incident response, remediation, and reporting. Security operations must disseminate appropriate information/intelligence to relevant stakeholders.
• Comprehensive logging and ticketing capabilities that document and communicate events throughout the threat collaboration environment.
• Tuning and tweaking of technologies to ingest collected data and enhance the analysis process.
• Enhance overall organizational situational awareness by reporting on security trends, escalating incidents, and sharing adversary tools, tactics, and procedures.

• Intrusion Detection Management
• Active Device and Event Monitoring
• Log Collection and Retention
• Reporting and Escalation Management
• Incident Management
• Audit Compliance
• Vendor Management
• Ticketing Processes
• Packet Capture and Analysis
• SIEM
• Firewall
• Antivirus
• Patch Management

• Event Analysis and Incident Triage
• Security Log Management
• Vulnerability Management
• Host Hardening
• Static Malware Analysis
• Identity and Access Management
• Change Management
• Endpoint Management
• Business Continuity Management
• Encryption Management
• Cloud Security (if applicable)

• SIEM with Defined Use Cases
• Big Data Security Analytics
• Threat Intelligence
• Network Flow Analysis
• VPN Anomaly Detection
• Dynamic Malware Analysis
• Use-Case Management
• Feedback and Continuous Improvement Management
• Visualization and Dashboarding
• Knowledge Portal Ticket Documentation
• Advanced Threat Hunting
• Control and Process Automation
• eDiscovery and Forensics
• Risk Management

Design and Implement a Vulnerability Management Program

Managing incident escalation and response. Coordinating root-cause analysis and incident gathering. Facilitating post-incident lessons learned.		Managing system patching and risk acceptance. Conducting vulnerability assessment and penetration testing.
Monitoring in real-time and triaging of events. Escalating events to incident management team. Tuning and tweaking rules and reporting thresholds.		Gathering and analyzing external threat data. Liaising with peers, industry, and government. Publishing threat alerts, reports, and briefings.

Info-Tech Best Practice

Ensure that information flows freely throughout the threat collaboration environment – each function should serve to feed and enhance the next.

Integrate Threat Intelligence Into Your Security Operations

Develop Foundational Security Operations Processes

Develop and Implement a Security Incident Management Program