Exabeam has released its annual State of the SOC report, identifying shifting roles and responsibilities as one of the most pressing challenges for security operations center (SOC) managers.
As an example of this shift, C-suite executives are doing more in incident response and threat hunting, while frontline employees are completing fewer operational tasks.
Similar to last year, the report also found that SOC staffing remains an issue, as do processes like reporting and documentation, along with alert fatigue and false positives.
The survey sought the opinions of IT professionals in the US and UK, with management responsibilities in operations and security.
Common roles targeted were CIO/CISO, SOC manager or frontline employee, such as threat researchers, security architects, engineers, analysts and risk officers.
Interestingly, only 5% of respondents reported seeing 100% of events in the security incident and event management (SIEM) system.
In fact, keeping up with security alerts presented the largest pain point experienced by SOC personnel (39%).
The top reason cited for this pain was the inability of legacy applications to log events.
Without full visibility into events happening throughout the enterprise, SOC managers are more likely to miss security alerts, resulting in greater vulnerability to cyber attacks.
"There's an idiom, 'what you don't know can't hurt you.' But in the information security business, that couldn't be further from the truth. In fact, it's what you don't know – or worse, can't see – that will significantly harm your business," says Exabeam chief security strategist Steve Moore.
"From our survey, an example of how this can manifest is a general lack of environmental visibility in the form of too few logs – you can't protect what you can't see.
"Visibility, event context and automation play a key role in building relevant defence, so you can have a fighting chance against even the most sophisticated adversaries.
Key findings:
- A third of respondents feel their SOC is understaffed by as many as 6-10 employees
- The importance of soft skills, like communication, is growing, with 65% of respondents saying personal and social skills play a critical role in the success of a SOC, but employees' actual abilities in these areas are also improving
- Hard skills have increased in importance; threat hunting is up 7 points to 69%, while data loss prevention jumped 8 points to 75%
SOC effectiveness remained unchanged YoY, with US SOCs having significantly more ability to monitor and review events (71%) than their UK counterparts (54%).
And smaller SOCs with fewer than 24 members reported an increase in effectiveness at 'responding to incidents' (79%).
However, a gap has emerged (54%) in the perception of the SOC's ability to perform auto-remediation. This is a 14% decrease from 2018, and likely due to SOC personnel's lack of understanding of the full security picture.
Other pain points for them include:
- Reporting/documentation (33%), false positives (27%) and alert fatigue (24%)
- Disparity with half the CISOs regarding the importance of incident response (52%) and incidents escalated (46%) versus SOC analysts for their view on the importance of incident response (24%) and incidents escalated (33%)
Nearly 50% of understaffed SOCs indicated they don't have sufficient funding for technology, while respondents of larger SOCs said that despite recent or increased funding for technology, they recommend continued investment in newer, more modern technologies (39%).
The survey also revealed that nearly half of SOC respondents continue to outsource business activities; malware analysis, threat analysis and threat intelligence are the most frequently outsourced functions. Conversely, SOCs are choosing to tackle event and data monitoring internally.
When technology investments are made, big data analytics (39%) and user and entity behaviour analytics (UEBA) (22%) remained strong, while artificial intelligence (23%) and machine learning (21%) made gains in usage rates.
In medium and smaller SOCs, usage of technologies like artificial intelligence and biometric authentication and access management also jumped.
