Monitoring.
Improving resilience to cyberattacks through rapid incident response
- Regular preventive cybersecurity tools alone are not enough to protect against all cyber threats.
- Effective protection is built on proactive collection and continuous monitoring of cybersecurity events.
- We would recommend conducting a business impact analysis (BIA) to identify critical areas to monitor.
- A security operations center (SOC) can provide full control over the events in your infrastructure.
- Before investing in a SOC, the company should make a reasoned decision about whether to staff its own team or outsource monitoring altogether.
Cybercriminals have many ways to conceal their activity, and this greatly complicates the task of ensuring cybersecurity. A typical example: an HR manager’s computer is being used to investigate account privileges, launch legitimate remote access software, and perform other actions that are unusual for an HR specialist.
Preventive cybersecurity tools, such as antiviruses, firewalls, and intrusion detection systems will not react to such activities, not with their default settings. They look for precise indicators of a cyberattack, like attempts to call known dangerous hosts, download malicious files, or install spyware. Requesting your account privileges or gaining remote access to the corporate network via typical software, on the other hand, is a perfectly legitimate action for most companies.
Nevertheless, a security specialist will understand how events can unfold. If the HR manager’s computer is compromised, the intruder can, at any moment, connect to it via remote access and implement malware, while the information about other user accounts will help amplify the attack.
To rule out potential hacking, such activities need to be tracked and controlled. This is what cybersecurity monitoring is all about.
Without threat monitoring, a company wouldn’t have a clue about a looming attack until after it happens—when it becomes impossible not to notice its effects, such as encrypted data on servers and workstations. A proactive approach, on the other hand, enables timely detection of illegitimate activity through centralized collection, systematization, and analysis of security events. This can be done in different ways.
Some organizations assign one specialist to monitor all security system alerts, like an antivirus being triggered by some suspicious activity. This kind of monitoring does not provide real protection as it only covers a fraction of the infrastructure.
A more advanced approach, practiced by many companies, is to implement a security information and event management (SIEM) system. It can collect data from different parts of the infrastructure, piece together a chain of events, and monitor alerts. Unfortunately, that may still be not enough merely because discovering the security event in itself is not enough.
It takes more to achieve a mature approach to cybersecurity and a comprehensive defense, namely:
- Predicting in advance what kind of incidents your company might encounter.
- Analyzing what exactly happened.
- Responding to the incident correctly.
- Working on your mistakes to prevent the same situation in the future.
To build such processes, you need to integrate security event monitoring with proactive threat analysis and incident response. An effective approach would be to assign these functions to a dedicated unit—security operations center. This can be done both with the company’s own resources and by engaging a third‑party team.
By linking technology, people, and cybersecurity, the SOC provides optimal protection in an environment where attacks are becoming increasingly sophisticated.
Below we will explore how a SOC operates and how to get the most out of it.
Before the implementation of monitoring, a company must institute a set of defenses that help protect against typical attacks. This step of the process can be referred to as prevention. The deployed security tools can automatically block known attacks, but many threat actors have long since learned how to bypass them. In order for a company to address “invisible” threats, it needs alternative security tools, such as monitoring systems.
In essence, the prevention phase is not directly part of the threat monitoring process, but an important precursor to it.
As we mentioned, most companies build cybersecurity monitoring based on SIEM systems. In this case, the process can be broken down as follows:
- The network is equipped with security tools: antiviruses, firewalls, network security scanners, and other systems whose main purpose is to automatically look for signs of compromise.
- These security tools, as well as network equipment, endpoints, applications, and other sources are used to collect security events, either passively or by installing agent software. The events are then fed into a SIEM system, where they go through a set of correlation rules to identify potentially dangerous activity. This can be referred to as the detection stage, which already belongs to the threat monitoring process.
- Any alerts triggered by the rules are analyzed by a team of specialists. If the threat is confirmed, the team initiates some countermeasures. This may include specialized IRP/SOAR
systems that run (at the command of the analyst or automatically based on the preset rules) response scenarios, or playbooks, for the type of incident detected. This is known as the response stage.
The SOC completes the cycle with two additional steps: i) continuous vulnerability exposure (prediction), which allows specialists to promptly address security gaps and reduce the likelihood of them being exploited by cybercriminals, and ii) insight extraction (lessons learned), to determine which events could have been averted during the prevention phase, and to improve the trigger rules. All together, this allows for the most comprehensive approach to cyber protection.
A large company approached us for SOC outsourcing. We set up a data exchange between our SOC’s SIEM system and the client’s antivirus software. At one point, the antivirus detected a malicious script on the mail server, the so‑called web shell that executes commands remotely. This information reached the SOC, and the work began.
- Quickly notified the client.
- Our analysts revealed a compromised account and several servers with a web shell. At the same time, it turned out that the attacker had obtained an account with domain administrator privileges and copied all usernames and passwords.
- We prepared recommendations to mitigate the damage. Thus, we suggested isolating the servers and resetting the passwords to all accounts.
- Using routine SOC tools, the analysts could not figure out how the intruder had penetrated the infrastructure. Hence, we called in our fellow colleagues from the forensics department to help with the investigation.
- Together, we identified the points of persistence used by the intruder and all the compromised accounts.
- The investigation revealed how the attacker had got into the infrastructure—through an external server that hosted the HR’s employee testing service. The company had launched the service long before reaching out to us. The vulnerability of the resource allowed any visitor to find out the usernames and passwords of employees who accessed the website.
- The key reason for the incident was a lack of emphasis on security in the prediction stage.
- Following the investigation, the team prepared recommendations to eliminate the consequences of the attack and improve cybersecurity processes.
-
PredictionThis stage was not taken into account which resulted in the incident
-
PreventionThe company was running an antivirus program in conjunction with a SIEM system hosted by an external SOC
-
DetectionWhen a malicious script was detected, the information was immediately sent to the SOC
-
ResponseThe specialists began to analyze the incident, localized the source of the threat, and initiated an investigation.This is where it became apparent that the incident was caused by a failure to address infrastructure vulnerabilities and weaknesses
-
Lessons learnedWe prepared recommendations on improving cybersecurity processes to prevent a repeated attack
In addition to common cybersecurity incidents, a company may experience other events that can impact its business goals. It is important for the SOC to detect such incidents. That is why they should also be placed on the monitoring list.
Consider a local wastewater treatment plant as an example. An attack on the automated process control system (APCS), an operator error, or an arbitrary command can cause a discharge of raw sewage. The result would be an environmental disaster, huge fines, or even criminal charges against those responsible. To reduce the damage from such an incident, technicians monitor the gate valve sensor around the clock. If the valve opens during inactive cleaning, the engineers on duty will be able to take immediate action. A security operations center would be the right technology platform for this, provided that you prepare adequate SIEM event correlation rules and write the playbooks.
This example shows how a standard cybersecurity incident like an attack on the APCS can cripple regular business practices, and how important it is to expand the playbook beyond mere cybersecurity. Because, in order to maintain business process continuity, the incident should be addressed by a chorus of business units: public relations, engineers, the legal department, etc.
The best way for an organization to detect such events and improve the general scope of monitoring is to conduct a business impact analysis (BIA). This will give a realistic idea of the consequences of incidents and help to locate relevant risk factors within the realm of cybersecurity and outside it. These may range from technical vulnerabilities in IT services, compatibility issues that result in the disruption of technological operations to business process failures. In the case example mentioned above, a timely BIA would have helped find the vulnerable HR portal.
- Determine the business impacts your company may suffer due to the exploitation of vulnerabilities.
- Identify the most disruptive scenarios that can lead to unacceptable consequences for your business.
- Detect not only the technical vulnerabilities of individual systems and resources, but also vulnerabilities related to systems interaction that can disrupt technological operations or business functions.
For example, a fire exit door only opens if certain nodes of the fire protection system exchange data. If the connection is interrupted, the exit remains closed. With a BIA, a company can quickly identify and eliminate that scenario.
- Prioritize known threats by their impact on business.
- Define the logic for detecting and preventing attacks that target both specific vulnerabilities and the interaction between systems.
For example, many companies host information systems on an external perimeter or in the cloud. As such services interact with the infrastructure via an API
, their performance depends on the limit of simultaneous connections. If the limit is exhausted, say, as a result of a DoS attack, the system will deny service. A BIA will help to flag such a scenario and point out the need to implement protective measures.
- Expand the event source pool to identify incidents related to system interaction attacks.
- Identify and correlate events to find instances where an ordinary cyber incident escalates into a malicious scenario.
As a result, you will be able to understand what playbooks your company needs during the response phase, how quickly to act, which business units to engage, and how to prioritize events correctly.
- Understand how the impact will build up over time and which units need to be involved to reduce or avoid the damage altogether.
- Determine the potential incidents, time to respond, and the required resources, so that the company does not incur critical damage.
- Evaluate to what extent the actual damage is consistent with the preliminary estimates.
- Analyze the damage that was avoided and how the new knowledge complements the BIA results.
This follow‑up work completes the cycle—the company draws conclusions for the future and compares its assessment of the cyber incident with reality.
The answer depends on the risk appetite that can be understood in the course of a BIA. It is necessary to consider the damage beyond the scope of the corporate IT infrastructure. Thus, a breakdown in business continuity may arise from failures of external services, which should also be identified by the SOC.
After the analysis, compare the costs of implementing your own SOC or outsourcing its functions with those of a delayed response to security events. Company management will be able to make decisions by evaluating specific scenarios. If it becomes clear that losses from certain incidents are unacceptable for your company, while the SOC does not overburden the budget, it makes sense to invest in preventing those critical losses.
Or perhaps it is the other way around: the potential losses do not justify the costs of the SOC. In this case, you can monitor individual key events and build response procedures for the most dangerous scenarios.
When a company finally decides that it does need a SOC, it has to determine whether to use its own resources or opt for the services of an expert organization.
The following questions will help you make that decision.
Companies believe that the systems processing and storing large amounts of valuable information are a higher priority for monitoring. However, this approach is not always the right one.
For example, if hackers penetrate these critical systems and publish the extracted database online, it will be too late to protect the information that has been compromised. But on the way to achieving the goal, the attacker needs to gain access to the infrastructure, conduct reconnaissance, create an account with the highest privileges, and so on. The company’s objective is to spot illegitimate actions as early as possible and react before the intruder has gained access to critical assets. Therefore, monitoring should not only cover such assets, but also all the preceding points that the intruder passes. These can be mail servers, user workstations, secondary information systems—the elements of infrastructure that are commonly not considered critical.
To create an effective private SOC, a company needs dedicated specialists who can properly rank the systems by significance. If your organization does not have such employees, outside experts can help.
It can take several years for a company to build and get its SOC up and running. The SOC must reach a certain level of maturity to be able to detect incidents that standard security measures fail to notice. The specialists need to develop an expert set of rules for identifying suspicious events, as well as keep them up to date, further align processes, and prepare playbooks—all this requires a lot of time and resources. For example, it took us more than four years to develop the 1,300 rules currently in our SOC database
A business impact analysis will show what time limits you can afford when responding to an incident. It may turn out that a one‑hour failure will have no effect on your business, two hours will cause problems, and two days of downtime will result in major financial and reputational damage. All this should be defined in your playbooks, which provide a clear response procedure. Some incidents must be addressed within minutes, including night times. Consequently, the SOC should operate around the clock, and, if highly specialized experts are needed, they must be engaged as soon as possible.
Maintaining your own 24/7 SOC is associated with high costs. The greater part of the expenses will be personnel—people need to be recruited and trained. An external SOC already has experienced professionals who deal with incidents in various industries on a daily basis.
There is no definite answer about whether it is less costly to create an in‑house SOC or to outsource it. Budgeting for these kinds of programs is done on a case‑by‑case basis. It depends on the size and expertise of staff, the required technical solutions and services, and other tools.
It is worth bearing in mind that in‑house and external SOC solutions belong to different budget lines. In the first case, we are talking about capital expenditures: equipment, software, licenses, premises, furniture. In the second, the costs are strictly operating.
Accordingly, the creation of an in‑house SOC requires a large initial investment, while outsourcing does not.
A SOC should recruit highly qualified specialists from the outset, and they should continually develop their expertise. That said, building a dedicated team might be a challenge in the current climate. There is a worldwide shortage
Important: Be aware of your country’s legal requirements for handling confidential information. You may need to follow certain rules in order to transmit data about security events outside the perimeter. An external SOC must already be licensed to do this kind of work.
Comparing the two models
| In‑house SOC | External SOC | |
|---|---|---|
| Systems criticality assessment |
Competent unassisted analysis |
Assisted analysis required |
| Time to launch |
May take years |
Realistically several weeks |
| Immediate response capability |
Yes, but more expensive; not easy to find specialists |
Yes |
| Costs |
More expensive; requires both capital and operating expenditures |
Cheaper; all expenditures are operating |
| Specialists |
Hard to find and takes time to adapt |
Readily available with the necessary qualifications |
Implementing incident monitoring is key to corporate cybersecurity. Otherwise, you become vulnerable to threats that may remain unnoticed. Probably, the worst would be spending the money without achieving the desired effect.
Start by analyzing the impact of events on your business to determine which approach to monitoring will ensure the expected results. Keep an up‑to‑date list of security events that affect your business resilience. This way, you will improve the overall quality of monitoring and enhance the cyber maturity of your organization.