SOCs Finally Turn Corner
March 12, 2018
Micro Focus has published its fifth annual State of Security Operations Report 2018, which reveals, for the first time since the report’s initial publication, an upward trend across all assessment areas. Despite the volume of threats rising, the report’s findings indicate that more mature Security Operational Centers (SOCs) are becoming more efficient in detection with greater ability to recover from breaches than ever before.While the report reflects positive momentum in organizations adopting and deploying security solutions, it also indicates that 20% of the cyber defense organizations assessed over the past five years failed to score a Security Operations Maturity Model (SOMM) level 1, which according to the model translates to a complete lack of capability. These organizations continue to operate in an ad-hoc manner with undocumented processes and significant cracks in security and risk management.
“Over the last five years, we have watched organizations attempt to achieve a complete security transformation by applying Band-Aids – such as the purchase of peripheral products or dismantling of solutions – only to find poor results and poor business alignment,” said Matthew Shriner, vice president, Security Professional Services for Micro Focus. “With that in mind, it is refreshing that when it comes to cyber defense capability, Micro Focus is seeing a much higher degree of operational sophistication than ever before. Nearly 25% of organizations assessed are meeting business goals, representing a nearly 10% year-over-year improvement.”
The Micro Focus State of Security Operations Report provides deep analysis on the effectiveness of organizations’ SOCs and best practices for mitigating risk in the evolving cybersecurity landscape. Over the last five years, Micro Focus has shared findings from 200 assessments of 144 discreet SOC organizations in 33 countries. It includes organizations in the public and private sectors, enterprises across all industry verticals, as well as managed security service providers. This is the largest available dataset to draw conclusions about the state of cyber defense and enterprise security operations around the globe.
Each SOC is measured on the Micro Focus SOMM scale that evaluates the people and processes, technology, and business capabilities. According to the report, organizations are beginning to see a return on their security investments and are seeing more value out of the security solutions they have deployed, reporting an average 8% improvement across people and processes, the two dimensions measured that have historically struggled most.
Key observations include:
The methodology for assessments is based on Micro Focus’s (formerly HPE’s) Security Operations Maturity Model (SOMM), which focuses on multiple aspects of a successful and mature security intelligence and monitoring capability including people, process, technology, and business functions. The SOMM uses a five-point scale – a score of “0” is given for a complete lack of capability while a “5” is given for a capability that is consistent, repeatable, documented, measured, tracked, and continually improved upon. The ideal composite maturity score for a modern enterprise is “3”, while managed security service providers (MSSPs) should target a maturity level between “3” and “4”. The reliable detection of malicious activity and threats to the organization, and a systematic approach to manage those threats are the most important success criteria for a mature cyber defense capability.
For more, the full methodology is detailed in the report, as well as feedback on key factors to the success that contributed toward the upward shift in this year’s report based on feedback from leaders that performed year-over-year assessments.