WEBVTT 0:00:03.920000 --> 0:00:06.760000 Hello everyone and welcome to this video. 0:00:06.760000 --> 0:00:10.920000 In this video we're going to be taking a look at SOC maturity models and 0:00:10.920000 --> 0:00:15.360000 frameworks. So you may be a little bit confused as to what this is referring 0:00:15.360000 --> 0:00:19.520000 to, but I promise you it's very, very important not just again if you're 0:00:19.520000 --> 0:00:24.600000 a beginner or you want to get or you want to become a SOC analyst or an 0:00:24.600000 --> 0:00:31.620000 incident responder, but it'll sort of give you an idea as to how you can 0:00:31.620000 --> 0:00:37.880000 measure the maturity level of a particular SOC and consequently improve 0:00:37.880000 --> 0:00:43.960000 it, which is something you may end up being responsible for if you become 0:00:43.960000 --> 0:00:49.940000 the manager of a SOC for example and you need to understand how SOCs in 0:00:49.940000 --> 0:00:56.440000 general are graded or rated in terms of their maturity and that's what 0:00:56.440000 --> 0:00:57.840000 we're going to be exploring. 0:00:57.840000 --> 0:01:01.620000 So we're going to take a look at the various models and frameworks that 0:01:01.620000 --> 0:01:07.320000 can be used that exist but can be used to sort of identify or determine 0:01:07.320000 --> 0:01:13.780000 just how mature a particular SOC is and of course this may not be important 0:01:13.780000 --> 0:01:19.240000 to you if you're not yet, if you've never worked in a SOC before, but 0:01:19.240000 --> 0:01:21.680000 I think it's quite important. 0:01:21.680000 --> 0:01:24.680000 So let me re-explain what I just said. 0:01:24.680000 --> 0:01:29.020000 So when we say SOC maturity, what do we mean here? 0:01:29.020000 --> 0:01:36.160000 Well, a SOC maturity model defines the capability, effectiveness and as 0:01:36.160000 --> 0:01:40.440000 I mentioned in multiple times in the other videos, the operational maturity 0:01:40.440000 --> 0:01:47.300000 of a SOC in detecting, responding to and mitigating security incidents. 0:01:47.300000 --> 0:01:51.760000 So it's sort of like an assessment of a SOC to determine whether you know, 0:01:51.760000 --> 0:01:59.080000 to determine its ability to detect, respond to and mitigate security incidents. 0:01:59.080000 --> 0:02:04.200000 And the reason this is important to why SOC maturity models and framework 0:02:04.200000 --> 0:02:08.960000 exists is because organizations hopefully evolve their SOC capabilities 0:02:08.960000 --> 0:02:13.940000 based on their security needs, available resources and risk tolerance. 0:02:13.940000 --> 0:02:19.760000 So the bottom line is that a mature SOC is proactive automated, which 0:02:19.760000 --> 0:02:24.540000 is sort of a new paradigm, if you will, and aligned with industry frameworks 0:02:24.540000 --> 0:02:29.360000 in order to detect, investigate and mitigate advanced threats efficiently. 0:02:29.360000 --> 0:02:33.260000 And the keyword there is advanced threats or contemporary threats. 0:02:33.260000 --> 0:02:36.940000 So the modern SOC is really evolving quite quickly. 0:02:36.940000 --> 0:02:42.200000 And these models are sort of being updated alongside them. 0:02:42.200000 --> 0:02:46.220000 We have new models coming up all the time. 0:02:46.220000 --> 0:02:49.800000 But the ones I'm going to be showcasing here have stood the test of time 0:02:49.800000 --> 0:02:53.700000 in terms of accurately telling you where you are, in terms of your SOC 0:02:53.700000 --> 0:02:58.540000 or just how mature the SOC that you're working in is. 0:02:58.540000 --> 0:03:05.820000 So why does SOC maturity matter if it isn't already obvious or obvious 0:03:05.820000 --> 0:03:11.700000 already? A, it ensures scalability and more importantly, adaptability 0:03:11.700000 --> 0:03:14.040000 to the evolving cyber threats. 0:03:14.040000 --> 0:03:18.700000 Threat actors are evolving in all ways, pretty much in terms of their 0:03:18.700000 --> 0:03:22.740000 trade craft, the tools they use, the malware, so on and so forth. 0:03:22.740000 --> 0:03:27.360000 And you need to ensure that your SOC is always doing the line or is always 0:03:27.360000 --> 0:03:32.560000 up to scratch. B, it reduces incident response time and enhances detection 0:03:32.560000 --> 0:03:36.700000 capabilities. That will become apparent shortly. 0:03:36.700000 --> 0:03:41.640000 C, it aligns SOC operations with industry best practices and compliance 0:03:41.640000 --> 0:03:47.220000 standards. So it brings you to the international standard, if you will, 0:03:47.220000 --> 0:03:49.500000 or the industry standards. 0:03:49.500000 --> 0:03:54.140000 And these maturity models and frameworks are a great way. 0:03:54.140000 --> 0:04:01.240000 If you're actually building a SOC, these are great models or frameworks 0:04:01.240000 --> 0:04:08.780000 or these models and frameworks are a great starting point in identifying 0:04:08.780000 --> 0:04:15.720000 the maturity level of the SOC that you're building in terms of where it 0:04:15.720000 --> 0:04:17.200000 will be when you're done. 0:04:17.200000 --> 0:04:23.540000 But then it gives you these waypoints or ways in which you can then mature 0:04:23.540000 --> 0:04:29.300000 and evolve your SOC as time goes on. 0:04:29.300000 --> 0:04:35.180000 And D, it helps organizations measure progress and identify gaps in security 0:04:35.180000 --> 0:04:40.520000 operations. And in my case, these majority models and frameworks were 0:04:40.520000 --> 0:04:45.400000 really important in that latter point identifying gaps in the security 0:04:45.400000 --> 0:04:51.260000 operations. So SOC maturity is often evaluated using structured maturity 0:04:51.260000 --> 0:04:55.840000 models that assess and organization security capabilities from basic, 0:04:55.840000 --> 0:04:56.600000 what we would call reactive. 0:04:56.600000 --> 0:05:02.260000 I told you that word would be important when we talked about the reactive 0:05:02.260000 --> 0:05:07.840000 and proactive services or capabilities to advanced, which would be considered 0:05:07.840000 --> 0:05:09.740000 proactive and automated. 0:05:09.740000 --> 0:05:15.640000 So bottom line is that it is therefore vitally important to familiarize 0:05:15.640000 --> 0:05:19.420000 yourself with these models before you begin implementing them or begin 0:05:19.420000 --> 0:05:29.520000 trying to use them as a baseline or basis for judging or rating the maturity 0:05:29.520000 --> 0:05:33.480000 level of a particular SOC regardless of whether you work in one or not. 0:05:33.480000 --> 0:05:36.120000 But it's very important that you understand them. 0:05:36.120000 --> 0:05:42.720000 So the first and I would say the most widely used one is the Gartner SOC 0:05:42.720000 --> 0:05:47.880000 maturity model. So Gartner classifies SOC maturity into five levels ranging 0:05:47.880000 --> 0:05:52.200000 from minimal capabilities to fully automated threat intelligence driven 0:05:52.200000 --> 0:05:56.520000 SOCs. So they have five levels of maturity. 0:05:56.520000 --> 0:06:00.100000 So level one being the lowest level five being, you know, state of the 0:06:00.100000 --> 0:06:06.360000 art. So level one is what they classify as minimal or an ad hoc SOC. 0:06:06.360000 --> 0:06:08.060000 There's a lot of them out there. 0:06:08.060000 --> 0:06:13.220000 So the description is self explanatory is there's no formal SOC. 0:06:13.220000 --> 0:06:18.120000 There's no 24 seven monitoring and securities handled reactively or in 0:06:18.120000 --> 0:06:19.380000 a reactive fashion. 0:06:19.380000 --> 0:06:23.840000 You then have level two, which is a developing SOC, right, or a reactive 0:06:23.840000 --> 0:06:29.480000 SOC. So in this case, this is a basic SOC with a lot of manual processes. 0:06:29.480000 --> 0:06:32.460000 There's very little automation, a lot of manual stuff, a lot of stuff 0:06:32.460000 --> 0:06:33.900000 in spreadsheets. 0:06:33.900000 --> 0:06:36.580000 Nothing formalized, no documentation. 0:06:36.580000 --> 0:06:40.100000 There may be playbooks, but they're stored in the four, they're stored 0:06:40.100000 --> 0:06:45.680000 on, they're stored on individuals, PCs and stuff like this, nothing is 0:06:45.680000 --> 0:06:50.380000 shared. But the key characteristics of a level two or reactive SOC, you 0:06:50.380000 --> 0:06:54.260000 know, based on the Gartner SOC maturity model are, you know, security 0:06:54.260000 --> 0:06:59.220000 monitoring exists, but lacks automation and proactive threat hunting. 0:06:59.220000 --> 0:07:03.660000 Okay, so let's say you are at a at level two, your SOC, the one you work 0:07:03.660000 --> 0:07:07.020000 in or the one you manage is a level two reactive SOC. 0:07:07.020000 --> 0:07:12.180000 Well, it then gives you an idea of what you need to incorporate to then 0:07:12.180000 --> 0:07:16.240000 move to a level three, which brings us to level three, which is a defined 0:07:16.240000 --> 0:07:21.020000 or operational SOC, the description self explanatory, this is an established 0:07:21.020000 --> 0:07:26.600000 SOC. So key characteristics are security incidents are detected triaged 0:07:26.600000 --> 0:07:31.020000 and responded to systematically so that they, you know, if we go back 0:07:31.020000 --> 0:07:34.600000 to the pillars of a SOC, the people aspect is sorted out. 0:07:34.600000 --> 0:07:43.100000 You now have roles and you have hired capable people, you have all the 0:07:43.100000 --> 0:07:47.020000 tools, the second pillar, you have the tools going, you have them set 0:07:47.020000 --> 0:07:51.960000 up, everything's done, there's automation, three, the third pillar, which 0:07:51.960000 --> 0:07:57.640000 is the processes, you know, everything is performed systematically, because 0:07:57.640000 --> 0:08:03.140000 you have defined processes, escalation, you know, all that good stuff. 0:08:03.140000 --> 0:08:06.780000 So level three, defined or operational SOC. 0:08:06.780000 --> 0:08:10.820000 Level four is what you'd call a managed or proactive SOC. 0:08:10.820000 --> 0:08:15.540000 So the description, as it says here, this is an advanced SOC with automation 0:08:15.540000 --> 0:08:20.260000 and analytics, the advanced side is really the analytics aspect. 0:08:20.260000 --> 0:08:24.420000 So the key characteristics are that it incorporates threat intelligence, 0:08:24.420000 --> 0:08:28.480000 the fourth pillar, remember, I mentioned it, behavioral analytics, and 0:08:28.480000 --> 0:08:39.100000 of course, proactive but threat hunting is, you know, is quite an advanced 0:08:39.100000 --> 0:08:44.220000 specialization. We'll obviously be exploring it in this learning path. 0:08:44.220000 --> 0:08:48.060000 And then you have level five, which is optimized, this is an intelligence 0:08:48.060000 --> 0:08:50.280000 or intel driven SOC. 0:08:50.280000 --> 0:08:55.240000 So the description, as it says here, fully integrated and automated SOC. 0:08:55.240000 --> 0:09:00.220000 So, you know, key characteristics are that it utilizes or leverages artificial 0:09:00.220000 --> 0:09:03.960000 intelligence, machine learning driven threat detection. 0:09:03.960000 --> 0:09:08.080000 There's a saw again, don't worry about what a saw is, is very advanced, 0:09:08.080000 --> 0:09:13.060000 will I'll break it down and explain it to you, and has automated response 0:09:13.060000 --> 0:09:16.640000 actions. So think of active defense and stuff like this. 0:09:16.640000 --> 0:09:20.740000 So this is the Gartner SOC maturity model, you can see it's already giving 0:09:20.740000 --> 0:09:24.920000 you an idea, if you work in a SOC of where you are, and what you can do 0:09:24.920000 --> 0:09:28.760000 to move to the next level, if indeed you want to move to the next level, 0:09:28.760000 --> 0:09:34.400000 because this is a maturity, it's not a competitive thing. 0:09:34.400000 --> 0:09:40.060000 But then we have another important or very useful framework, not a maturity 0:09:40.060000 --> 0:09:44.820000 model, and that's the NIST cybersecurity frameworks or the CSF. 0:09:44.820000 --> 0:09:50.120000 And the NIST CSF provides a roadmap for SOC maturity based on five security 0:09:50.120000 --> 0:10:02.380000 functions. So it's not it uses security functions. 0:10:02.380000 --> 0:10:08.180000 And, you know, we pretty much, we pretty much outlined these functions 0:10:08.180000 --> 0:10:12.240000 in the previous video, although they have, they have slightly different 0:10:12.240000 --> 0:10:19.020000 names, but SOC alignment with the NIST CSF involves, you know, so in terms 0:10:19.020000 --> 0:10:23.620000 of understanding it, or how they describe it is that a basic SOCs focus 0:10:23.620000 --> 0:10:28.020000 on detecting and responding to security threats, mature SOCs integrate 0:10:28.020000 --> 0:10:31.840000 threat intelligence automated detection and proactive defense measures 0:10:31.840000 --> 0:10:33.640000 across all five functions. 0:10:33.640000 --> 0:10:37.400000 So in terms of the functions and the descriptions you have identified, 0:10:37.400000 --> 0:10:41.540000 so understanding business risks, asset inventory and threat landscape 0:10:41.540000 --> 0:10:46.080000 protect involves implementing access control data security and endpoint 0:10:46.080000 --> 0:10:53.720000 protection. Detect involves monitoring, detecting anomalies and identifying 0:10:53.720000 --> 0:10:59.020000 threats, respond involves containment eradication and mitigation of security 0:10:59.020000 --> 0:11:03.700000 incidents, recover, as the name suggests, involves restoring operations 0:11:03.700000 --> 0:11:07.620000 lessons learned and continuous improvement. 0:11:07.620000 --> 0:11:12.200000 And then you have another useful one, which I personally like as well, 0:11:12.200000 --> 0:11:15.160000 because it's quite similar to the Gartner maturity model, and that is 0:11:15.160000 --> 0:11:19.540000 the capability maturity model integration or CMMI for SOCs. 0:11:19.540000 --> 0:11:24.140000 CMMI measures SOC maturity across five levels similar to Gartner, but 0:11:24.140000 --> 0:11:27.940000 with an emphasis on process optimization, which is the aspect that I really 0:11:27.940000 --> 0:11:30.920000 like, as well as continuous improvement. 0:11:30.920000 --> 0:11:35.720000 So they have five levels, so level one to level five, level one being, 0:11:35.720000 --> 0:11:41.640000 you know, the most basic level five being the most advanced or most mature, 0:11:41.640000 --> 0:11:44.380000 I should say, level one is initial. 0:11:44.380000 --> 0:11:49.800000 So in this case, no structured SOC ad hoc instant handling, just like 0:11:49.800000 --> 0:11:55.560000 Gartner. Level two is a managed, you know, level two managed, in this 0:11:55.560000 --> 0:12:00.800000 case, basic instant response procedures, very minimal automation if any. 0:12:00.800000 --> 0:12:05.920000 Level three is a defined SOC, so in this case, standardized SOC processes, 0:12:05.920000 --> 0:12:11.040000 monitoring and threat detection capabilities exist, or, you know, that's 0:12:11.040000 --> 0:12:12.700000 what you would expect at that level. 0:12:12.700000 --> 0:12:17.660000 Level four is a quantitatively managed SOC, so again, very interesting 0:12:17.660000 --> 0:12:22.480000 names, but, or maturity level, if you will. 0:12:22.480000 --> 0:12:30.360000 In this case, the primary thing is Intel driven incident response with 0:12:30.360000 --> 0:12:35.080000 automated analytics, and then level five is called optimizing. 0:12:35.080000 --> 0:12:39.420000 In this case, I don't know why they call it that, but based on the description, 0:12:39.420000 --> 0:12:42.940000 you can pretty much sort of understand why it's called optimizing or that 0:12:42.940000 --> 0:12:46.080000 maturity level is called optimizing. 0:12:46.080000 --> 0:12:49.880000 In this case, you know, fully automated SOC, AI powered SOC with continuous 0:12:49.880000 --> 0:12:51.900000 improvement built in. 0:12:51.900000 --> 0:12:57.820000 So that's the capability maturity model integration for SOCs or CMMI, 0:12:57.820000 --> 0:12:59.200000 another great one. 0:12:59.200000 --> 0:13:02.880000 And then you have the MITOTAG based SOC maturity, which is actually a 0:13:02.880000 --> 0:13:06.760000 great one, you know, if you want to keep things relatively simple, if 0:13:06.760000 --> 0:13:14.960000 you're not familiar with in other courses in this learning part. 0:13:14.960000 --> 0:13:18.620000 So MITOTAG is an adversary tactics techniques and procedures framework 0:13:18.620000 --> 0:13:23.120000 that helps SOCs or analysts in general, enhance threat detection, intelligence 0:13:23.120000 --> 0:13:26.280000 driven defense and adversary emulation. 0:13:26.280000 --> 0:13:30.740000 They have three maturity levels, basic and immediate and advanced, but, 0:13:30.740000 --> 0:13:34.100000 you know, you have the level sort of divided amongst these three, so level 0:13:34.100000 --> 0:13:39.680000 one is basic, intermediate is level two or three, and advanced is level 0:13:39.680000 --> 0:13:46.040000 four or five. So basic or level one, in this case, the SOC detects commodity 0:13:46.040000 --> 0:13:51.420000 malware and known attack signatures. 0:13:51.420000 --> 0:13:56.820000 And again, in this case, it's basing it off adversarial trade craft or 0:13:56.820000 --> 0:14:03.800000 its ability to detect the TTPs of a threat actor, as well as, you know, 0:14:03.800000 --> 0:14:08.140000 the tools, etc. So that's why level one, you know, detects commodity malware 0:14:08.140000 --> 0:14:09.480000 known attack signatures. 0:14:09.480000 --> 0:14:13.620000 So staff is already known in immediate all level two or three. 0:14:13.620000 --> 0:14:18.420000 In this case, the SOC is able to detect known TTPs mapped to the MITOTAG 0:14:18.420000 --> 0:14:21.420000 framework incorporates behavioral analytics. 0:14:21.420000 --> 0:14:26.700000 These characteristics are not broadly assigned to the SOCs ability to 0:14:26.700000 --> 0:14:34.400000 do something, and then advanced, which is level four or five, in this 0:14:34.400000 --> 0:14:39.400000 case, proactive threat hunting, adversary simulation emulation, you know, 0:14:39.400000 --> 0:14:42.960000 either or, and MITOTAG based detection. 0:14:42.960000 --> 0:14:47.960000 So this is the reason why don't use this is because it's based on the 0:14:47.960000 --> 0:14:48.780000 attack framework. 0:14:48.780000 --> 0:14:54.320000 So it's not holistic, like the Gartner maturity model, but it can be very 0:14:54.320000 --> 0:14:59.880000 useful if you're sort of focusing or narrowing down on its maturity in 0:14:59.880000 --> 0:15:05.040000 relation to or using the MITOTAG framework to determine maturity. 0:15:05.040000 --> 0:15:11.460000 We also have another maturity model, which is the SOC CMM, which is an 0:15:11.460000 --> 0:15:16.140000 abbreviation for the SOC capability maturity model, as the name suggests, 0:15:16.140000 --> 0:15:20.560000 capability maturity, sort of the key aspect here. 0:15:20.560000 --> 0:15:25.320000 So the SOC CMM framework provides a structured assessment model for SOC 0:15:25.320000 --> 0:15:27.120000 maturity across five domains. 0:15:27.120000 --> 0:15:30.820000 So in this case, it's an assessment model for maturity, but you know, 0:15:30.820000 --> 0:15:34.220000 it does not prescribe maturity levels. 0:15:34.220000 --> 0:15:37.460000 It assesses maturity based on five domains. 0:15:37.460000 --> 0:15:42.740000 So in this case, you have the SOC CMM domains and then the evaluation 0:15:42.740000 --> 0:15:47.520000 criteria. So what they use to determine maturity with respect to these 0:15:47.520000 --> 0:15:49.780000 five domains, or each of these five domains. 0:15:49.780000 --> 0:15:54.860000 So in the case of the business domain, the evaluation criteria is SOC 0:15:54.860000 --> 0:15:57.260000 alignment with business and compliance goals. 0:15:57.260000 --> 0:16:02.720000 So it does SOC align with the business and compliance goals, you know, 0:16:02.720000 --> 0:16:08.620000 and then people, in this case, the evaluation criteria is training, skill 0:16:08.620000 --> 0:16:09.860000 sets and staff certification. 0:16:09.860000 --> 0:16:14.540000 So other people, remember that the people pillar? 0:16:14.540000 --> 0:16:17.340000 So are the SOC analysts trained? 0:16:17.340000 --> 0:16:21.540000 Do they have the necessary skills to operate effectively, etc? 0:16:21.540000 --> 0:16:27.320000 And then process, in this case, does the evaluation criteria is, does 0:16:27.320000 --> 0:16:32.260000 the SOC have a defined and repeatable, or I should say reliable incident 0:16:32.260000 --> 0:16:33.820000 response workflows? 0:16:33.820000 --> 0:16:35.460000 Have they been developed well? 0:16:35.460000 --> 0:16:40.640000 Do they take into consideration different types of factors, you know, 0:16:40.640000 --> 0:16:44.480000 etc, etc. You then have the technology domain. 0:16:44.480000 --> 0:16:50.960000 So is the SOC using a CMM, SOAR, EDR, threat intelligence platforms? 0:16:50.960000 --> 0:16:54.000000 You know, you can see this actually makes quite a lot of sense if you 0:16:54.000000 --> 0:16:57.480000 think about it from the perspective of domains. 0:16:57.480000 --> 0:16:59.160000 And then metrics. 0:16:59.160000 --> 0:17:04.060000 So the SOC have a data driven decision making and KPI tracking. 0:17:04.060000 --> 0:17:09.080000 And again, it's not a yes, it's not a positive or negative type of response. 0:17:09.080000 --> 0:17:14.080000 They sort of evaluated based on this criteria and give you a score. 0:17:14.080000 --> 0:17:17.200000 And based on that, there's sort of an aggregate or total score across 0:17:17.200000 --> 0:17:22.580000 all five domains that then tells you based on this maturity model, where 0:17:22.580000 --> 0:17:26.960000 you are, you know, maturity wise or where the SOC is maturity wise. 0:17:26.960000 --> 0:17:30.500000 With that being said, that's going to be it for this video. 0:17:30.500000 --> 0:17:36.280000 Hopefully you have a better understanding of, you know, how SOCs are ranked 0:17:36.280000 --> 0:17:43.540000 in terms of the next video.