The No-Nonsense Guide To Security Operations Metrics

The No-NonsenseGuide to SecurityOperations Metrics

The No-Nonsense Guideto Security Operations MetricsKPIs That Actually Work for Assessing Your SOC Progress and Driving ExecutiveSupport (Plus Actionable Advice for Improving Those Metrics)As the saying goes, there are two types of companies: Thosethat know they have been hacked – and those that just haven’tdiscovered it yet. The adage admittedly isn’t perfect, nor fair,as there are countless companies practicing defense in depthand performing due diligence by continuously assessing thethreat landscape and effectively putting people, process andtechnology to work to address them.But because every organization in the world is a target forcyber threats and data breaches, information security is arare discipline in which what should be the traditional hallmarkof success – “Nothing bad happened!” – isn’t an option.As a result, success becomes more difficult to define andmeasure, and companies must think long and hard aboutthe appropriate metrics for their business and technicalgoals. Still, metrics are an important part of cybersecurityand security operations programs. Being able to measureyour progress shows how well your security programis functioning and helps justify to executive leadershipand other stakeholders the security operations center(SOC) resources you require.Security teams are constantly asking for more budget forresources to improve their day-to-day operations.Yet, the SANS Institute found in its 2018 Security OperationsCenter Survey that just 54% of SOCs collected metrics,and most weren’t “business-relevant effectiveness metrics.”SANS said that without clear measurements, SOCsmay run into funding resistance due to their inabilityto communicate to management the value of the SOC andoverall security program.Knowing that securing more funding for additional hiresand new technologies rests on providing data-based proofraises an obvious question: Why aren’t more SOCs diligentlytracking their performance? For starters, many securityoperations teams say the reporting they provide requires asignificant amount of work to pull together. Between non-stopalerts, burned-out analysts, an overdependence on manualprocesses, skills shortages and security tools that don’tinteroperate, defining success – never mind approachingmetrics from a business perspective – can seemvirtually impossible.But for security operations to grow within your company,attesting to its value both internally and across the greaterorganization will be tantamount to your individual success.BEFORE YOU MEASUREThe first step to building your enterprise cybersecuritymetrics and security operations KPIs is setting clear directionas to what you are collecting and why. You will need a vision,long-term objectives and strategy before you can achieveexecutive stakeholder buy-in for your metrics program.Going the reverse route will result in a barrage of questionsand little in the way of support. Reduce the friction andexpedite approvals by clearly articulating a solid planand the concrete role leadership support plays. (In caseyou are wondering, yes, not only are you ultimately seekingexecutive-level support for your SOC, but also endorsementfor collection of data related to it.)Outside the executive suite, some stakeholders within the ITdepartment may feel a metrics program adds pressureto their teams because of the added visibility into their dayto-day operations. No one enjoys feeling like another groupwithin the organization is keeping tabs on them.Building and presenting your program to alleviate this concernis paramount to minimizing pushback. Framing the processand rationale as a way you are assisting with tighteningprocesses and technology for the organization as a whole isoften a good starting point. Also, go in prepared with a clearoutline of stakeholder roles and responsibilities. You’ll needto answer questions like:1. If an issue is determined via the metrics program,what is each stakeholder’s responsibility with regardto remediation efforts?2. How will information be reported to stakeholders?3. Will there be service-level agreements (SLAs) for solvingand correcting concerns within the metrics?

BUSINESS-ORIENTEDMETRICSEarlier, we established that no organization is immune from asuccessful cyberattack. But that doesn’t mean catastropheis inevitable. Those businesses that can reduce the harm thata successful compromise can impose will be able to stave offcostly consequences and revert to normal operating conditionsin a timely manner. Here are a few metrics that will help supportyour risk mitigation strategies, as well as convey risk to seniorleaders and the board.Time to Detection, Containment and EradicationKPIs in this category include mean time to detect, or MTTD,which reflects the amount of time it takes your team todiscover a potential security incident. Mean time to respond,or MTTR, is the time it takes to control, remediate and/oreradicate a threat once it has been discovered. And dwell timecaptures the entire length of a security incident, reflectingthe duration from when an attacker first enters your networkto the time they are removed and you have returned to aknown-good state.The impact of dwell time cannot be understated: It is duringthis window that adversaries have unrestricted access on yourenvironment, allowing them not just lateral movement butalso the ability to commit any number of damaging actions,including data theft, network and user reconnaissance, andadditional malware infections.Staff RetentionThe security operations center is a pressure-packed place,home to sophisticated threat assaults, disparate detectiontools firing off countless alerts and a widening skills chasm.But for as active a hub it is, your SOC can be home to greatdisaffection and mental exhaustion due to the humdrum tasksinvolved with working individual alerts. No analyst wants to bestuck doing the tedious stuff for long, and you shouldn’t wantthat either. The goal is to get your analysts partaking in morespecialized disciplines, like threat hunting and eradication. Andbecause of the much-maligned skills shortage, you’ll want toensure you offer a thriving environment in which to work.Remember: if the burnout doesn’t get them first, a competingemployer could.Other Business-Oriented Metrics to ConsiderMetricQuestions it can help answerFalse PositiveRatesHow many false positives is yourSOC experiencing in general or,more specifically, per product?This will help determine overalleffectiveness in deploymentand configuration of tools.Distribution ofRoot CausesWhat are the causes ofincidents? Root cause analysiscan help you determine whatneeds to change in termsof people, processesor technology.ThreatAttributionThis is likely the mostsophisticated of assessmentoptions for the SOC, reserved forthose security hubs experiencingelite proficiency. How well youunderstand the details of a threatcan be a strong indicator of theproficiency of your securityoperations, and it’s no surprisethat certain organizations willwant to add this metric to theirmeasurement repertoire. But bearin mind that threat attributionis complex and involvesorganizations using advancedintelligence and forensicevidence to determine the origin,motivations and sponsorsof attacks.Alert ReductionWith the average company receiving tens of thousandsof threats per week, not only are SOCs overwhelmed,they are also experiencing alert fatigue. Two typesof investigations generally occur in the SOC: alert-basedand threat-centric. Alert-based represents a one-to-onerelationship between case and alert. An alert comes in,enrichment and automation happen for the alert, and theanalyst completes the investigation. Analyst efficiency mayimprove, but the biggest problem in the SOC, the volumeof alerts, is left unresolved. To address alert volume aswell as meet the SOCs objectives, you must do more thansimply enrich alerts and automate some tasks. This involvesleveraging a threat-centric approach to investigations thatlooks for contextual relationships in the alerts and,if identified, groups these alerts into a single case.This will help you reduce the huge numbers of alerts youmust regularly confront.Service-Level AgreementsHave you been meeting the SLAs as jointly defined with thebusiness? For the SOC to win executive support, it must showit is aligned with business goals, including risk posture andcompliance requirements. SLAs help provide supervisedaccountability and ensure that the SOC is adequatelycommunicating with key departments, including compliance,legal, IT and human resources.