Olivier Caleff on why CSIRT/SOC is valuable for a CISO

It is critical for CISOs to get a global understanding and, if required, ask for additional details before taking decisions. Reporting from Security Operations (SecOps) teams, a SOC, or a CSIRT must be well defined to the benefits of the CISO. There are at least 3 elements at stake:

1. An understanding of the situation by the CISO, as perception of the environment is not enough. In turn the CISO will be able to fully play his governance role, providing guidance and directions to the SOC or the CSIRT;
2. Actionable data, as defined in a 2015 ENISA document, as the CISO needs relevant, timely, accurate, complete, and ingestible pieces of information, even though it takes time for the fog of war to lift;
3. The CISO must anticipate and project for the next steps based on facts, but more strategically too. Here human, business, legal aspects and priorities, will come on top. As the situation evolves, taking decisions – and logging them and the context will be useful for the final lessons learnt part – is expected along with reporting to the high level of the organisation.

2.4 Efficiency

You cannot simply rely on an organisation, processes, procedures, tools that have been set up some times ago. As the threats are evolving, you must also adapt. So first, you need to assess how mature and aligned your cybersecurity organisation is.

There are at least 2 categories of metrics that should be known:

1. The real coverage of the NOC, SOC, CSIRT, and SecOps teams;
2. The level of efficiency or performance of the security solutions and security processes set in place.

The former can be known through an objective assessment of the known IT and OT perimeters and provide a real assessment of the knowledge and ability to manage assets in the perimeter of the organisation.
The latter can be achieved with technologies such as the BAS (Breach Attack Simulation) which, thanks to attack simulation in real-life, enables to assess whether detection and reaction security tools have been well tuned, and what is the ability of the teams to behave as expected by detecting and qualifying events into incidents, follow the procedures to escalate to the CISO and act. This is key and this will help detect blind spots in your SOC and CSIRT activities. And this is why BAS and Red Teaming are different.

At least 2 reports published in 2023 (based on the results of hundreds of BAS campaigns) are eye-opening on how organisations fare when it comes to MITRE ATT&CK Tactics. They provide valuable insight of where pain points are and help CISOs, SOCs, and CSIRTs improve their technical and organisation coverage.

What’s in a name? The question relates to the SOC, but in some organisations, SecOps are in the perimeter of a group whose name may vary a lot: SOC, OpsTeam, CyberTeam, or even… CSIRT. What’s important is that all required activities are addressed, all stakeholders work with cooperation in mind. They can even be split between internal or external teams.

• First and foremost, the CISO must be vigilant that the sharing of relevant data between the stakeholders – NOC(s), SOC(s), VOC(s), CSIRT… – is well set and efficient. It is his/her responsibility to cover all activities.
• Second, the ‘SOC Capability Maturity Model’ (SOC-CMM) and the widely recognised Security Incident Management Maturity Model (SIM3) are the best ways to assess the maturity of each group, and link with the expected activities. FIRST working groups (SIG) already published ‘Services Frameworks‘ for CSIRTs and PSIRTs that are de facto standards in the Incident management communities. In October 2023, they released a new draft titled ‘Incident Management Team Types‘ which helps to clarify the needs and requirements for CSIRT roles and enables quick(er) and more consistent writing of role descriptions. In addition, it provides a clear overview of specific competencies that are important in handling the functions and tasks related to specific services provided.

Whether these entities should be internal or subcontracted, really depends on the context, the level of expertise of cybersecurity teams, level of maturity, and width of perimeter coverage, just to name a few criteria.