Almost Half of Organizations Have No Security Operation Center, Hindering Detection of Advanced Threats

Even though Security Operation Centers (SOCs) are increasingly common, some 48 percent of organizations don’t have one, a recent survey shows. This creates many security challenges, such as: slower identification of intrusions, ad-hoc or no processes following a security breach, inability to efficiently protect the most valuable assets from advanced attacks, and delayed isolation of corrupted infrastructures.

A Security Operations Center (SOC), or the company’s cyber threat detection function, is a centralized, structured and coordinating hub for all cybersecurity activities.

Moreover, 57% of organizations do not have, or only have an informal, threat intelligence program, while another 12% feel it is very likely they would detect a sophisticated cyber attack.

Detection and response capabilities allow these companies to easily and immediately detect the attack and react to minimize the impact on its network, brand reputation and customers.

More specifically, endpoint detection and response tools best fit resource-strapped businesses with lean IT teams that lack a dedicated cybersecurity hub, or SOC.

In addition to the improved detection and response approaches to prolific security incidents, EDR tools also address the shortage of cybersecurity talent. Most information security professionals admit having too few hands on deck to address current threats, while the number of cyber threats rises to new records each year.

EDR tools that don’t have a priority or severance-based alert filtering mechanisms can actually slow the detection and response process of real threats. As a result, IT and security staff can be sent down on investigation paths that either lead nowhere or are trivial. EDR alerts should not be about the sheer number of triggered alerts, but about intelligent, reliable, and meaningful alerts with a high probability of pointing to a real threat. Traditional EDR tools may seem like a security enabler, but without dedicated and staffed SOC teams, they may either hinder the organization’s security capabilities or make no significant contribution to the overall security posture.

With no SOCs in place, CISOs complain about different security flaws. Sixty-four percent of Americans in companies with no SOC said monitoring activities is one of their toughest challenges. Europeans also perceive the speed to investigate suspicious activities and the ability to quickly respond and remediate potential threats as challenges the might weaken their security posture. Survey results are available here.

When considering EDR solutions, Bitdefender security specialists strongly advise enterprise CISOs to consider the importance and value of an integrated, prevent-detect-investigate-respond-evolve approach to endpoint security:

• Prevent: block all known bad and a high percentage of unknown bad at pre-execution layer itself, without saturating the EDR analytics engine with unnecessary incident alerts
• Detect: supported by built-in intelligence from threat protection engines and analysis of a stream of behavioral events from an endpoint event recorder
• Investigate: aided by contextually relevant information on the class of threat that is detected (via the built-in intelligence), the reason of detection (via threat analytics), and ultimate verdict (via an integrated sandbox)
• Respond: via a single-pane incident-response interface that enables tactical remedial actions immediately and widely across the enterprise
• Evolve: enables the feedback loop from current detection to future prevention via in-place policy tuning and fortification