In the post-pandemic ‘new normal,’ businesses continue to embrace new working models powered by digital transformation, particularly cloud technologies.
Eight out of ten employees indicated support for hybrid work models as the future norm, while 86% of businesses expect to accelerate cloud adoption post-pandemic.
While urgent solutions to support remote and distributed workforces have fuelled transformation across the business world, hackers have also upped their capabilities. Today, the hackers’ bag of tricks is increasingly targeted and complex, meaning awareness, vigilance, and education are vital weapons and our most critical line of defence. Every day 450,000 new pieces of malware are detected, and 3.4 billion phishing emails hit inboxes. Nearly half of organisations responding to our latest survey listed malware such as ransomware as a significant concern. Against an evolving and increasingly sophisticated threat landscape comes further headwinds as businesses grapple with cybersecurity workforce shortages and strict industry compliance regulations, all while trying to evolve the technology to meet the challenge.
Just as organisations embrace modern working and next-generation technologies, security operations must modernise, going beyond responsive defence to build in resilience through proactive protection. Modern SecOps leverages personnel, processes, and tools to promote measurable results in securing infrastructure and business processes.
Our latest research breaks down the core priorities for today’s SecOps modernisation. In a world where cybercriminals are capitalising on business growth and ever-changing business patterns, it’s time to stop hackers dead in their tracks by benchmarking SecOps status and taking proactive steps to transform it. Spanning the fundamentals of people, process, and technology, a new approach that tackles the obstacles and builds a shared framework to ensure business resilience is mission critical.
The perennial people problem
61% of businesses say that staffing and workforce are their primary SecOps concern. The human factor is an ongoing challenge for SecOps, but there exists a duality. On the one hand, people have become the primary attack vector for cyber attackers; humans rather than technology now represent the most significant risk to organisations.
To effectively manage human risk, people are also the solution. For example, security awareness professionals are vital in managing workforce education – the most mature security awareness programs have the largest number of people dedicated to managing and supporting it.
However, the similarly well-recognised cybersecurity skills crisis still rages. 62% of organisations struggle with staffing cyber roles. There are myriad reasons why this challenge persists. Data growth, technological changes, and compliance requirements make maintaining adequate cyber talent and resourcing challenging due to the complexity and cost of maintaining these capabilities.
Retention complicates this dynamic. Where talent exists, 64% report SecOps personnel are professionals with five years or less experience. Cyber professionals will often endure the strain of SecOps work at the start of their careers, but most do not want that to define their career long-term.
In response, many organisations are increasingly outsourcing cyber functions to distributed global and managed security service providers. However, security orchestration, automation, and response (SOAR) tools have also become standard, deployed in many security operations centres to increase the efficacy of existing staff.
Automation meets the human factor.
A SecOps analyst must detect and respond to a high-severity incident within an hour.
Staff shortages impact response times, yet the expectations of organisations to remedy issues remain high. We asked organisations what the average mean downtime they would be willing to accept during a high-severity incident, such as a ransomware attack. Nearly a quarter said they would tolerate six hours, 20% reported 24 hours, and 13% reported one hour. Stakeholder expectations of downtime don’t align with resourcing commitments.
With this in mind, security orchestration, automation, and response (SOAR) tools that quicken response times and ensure greater accuracy can be considered part of any SecOps modernisation strategy.
The rapid evolution of technology produces more signals for a cyber analyst to evaluate, driving requirements for automation. SOAR tools help human analysts do vital SecOps work quickly and effectively by automating routine actions, resulting in fewer mistakes, while orchestration among many systems provides efficiency. Such tools empower SecOps professionals to make decisions confidently while empowering the organisation to implement limits on what any individual can do. This maintains separation of duties within compliance, policy, and legal constraints to minimise the likelihood of system damage and legal liability.
However, while SOAR is complementary to SecOps functions, it is not a silver bullet for staffing shortages. Organisations told us that incident response (34%) and automation (15%) are listed as the greatest SecOps strengths, although 30% of respondents also noted automation as one of their SecOps programme’s most significant weaknesses. These findings indicate that SOAR can increase the efficacy of existing staff but can’t replace staffing entirely.
Artificial intelligence and machine learning can boost analytical procedures and help humans scale their analytical functions but cannot replace human talent. A modern SecOps strategy will appreciate this delicate balance and weigh investment in recruitment and retention alongside essential tools and technologies.
A matrix of modernisation technologies
While talent is a constant challenge for SecOps, for those seeking to mature their operations, cybersecurity tooling, such as SOAR technologies, arguably represents the other most critical element. According to PwC, almost two-thirds of UK organisations increased cyber security budgets in 2022 compared to 56% in 2021.
Our findings indicate an increased migration from traditional to more cloud-based and integrated tooling suites. Budget shortages, digital transformation to the cloud, remote-work cultural changes, and the need to mature programs are the dominant driving factors behind technological adoption across various product types.
Right now, Endpoint detection and response (EDR), security information event management (SIEM), vulnerability management, and network detection and response (NDR) are seen as central. Respondents to our survey reported EDR and SIEM as the strongest tools in their current arsenal. Forensics and emergent cloud workload protection platforms CWWPs are currently the weakest.
Interestingly, however, it seems that despite some concerns, modernisation is migrating toward emergent capabilities such as NDR and CWWPs.
NDR tools monitor and analyse network traffic in the cloud and on-premises, detecting threats using AI/ML and providing investigative and response capabilities. CWWPs Provide visibility, hardening, and vulnerability management for cloud-based workloads – essential for today’s cloud-powered workforce. Looking forward three years, it seems the future leans toward cloud security, threat intelligence, and security application development as the dominant trends.
Realising SecOps modernity
The pandemic created a technological revolution to support globally distributed and remote workforces, opening opportunities for threat actors to ramp up activity.
There is a desperate need to mature SecOps programmes. Cyber staffing shortages are the overarching challenge – the SecOps industry cannot secure data with the available workforce, and SOAR is not a cure-all. SecOps modernisation is migrating toward emergent capabilities such as NDR and CWWPs, and technological integration is key to these strategies., but people will underpin all aspects of technological modernisation.
However, there is a disconnect between stakeholder understanding and resourcing. This is especially prevalent within the people problem. This problem spans recruitment and retention but also mitigation for the most vulnerable area of SecOps – the human factor. Modernisation through technology is a vital part of the modernisation matrix. Still, it is clear that much more needs to be done to close gaps in knowledge, skills, awareness, and compliance – this can be seen as the bedrock of the cybersecurity process. As such, knowledge is the foundation of any modernisation effort. Only once people, processes and technology are equally matched will modernisation come to fruition.
About the Author
John Davis is UK & Ireland Director at SANS Institute. SANS is the most trusted and by far the largest source for information and cybersecurity training and certification in the world. It also develops, maintains, and makes available at no cost, the largest collection of research documents about various aspects of information security, and it operates the Internet’s early warning system – Internet Storm Center.
