EP263 SOC Refurbishing: Why New Tools Won't Fix Broken Processes (Even With AI)

Key takeaways

Effective security requires integrating people, processes, and technology; technology alone cannot solve foundational process issues.
Superficial technology upgrades, like replacing a SIM, do not constitute true SOC transformation. Process modernization is key.
Federated SOC models offer specialization benefits but require strong integration and consistent visibility across regions and tools.
Relying solely on EDR for detection is insufficient; organizations must deploy layered detection mechanisms covering the entire attack surface.
AI has the potential to unify signals from multiple detection tools but depends on comprehensive data access and quality.
Organizational metrics like mean time to contain (MTTC) and detection coverage are essential for measuring security effectiveness and response agility.
Many teams still depend on Excel for managing security incidents; improved UI/UX and data integration could enhance operational efficiency.
Security leaders should focus on refining processes, leveraging modern tools thoughtfully, and maintaining a clear mission to succeed in threat detection and response.

Summary

Bridging the Gap Between Executive Goals and Ground-Level Operations

This section emphasizes the importance of aligning high-level strategic objectives set by CISOs and boards with the reality of daily security operations. Danny Lyman discusses how organizations often focus too heavily on technology upgrades, neglecting processes and people, which are crucial for effective security. A key message is that successful security teams need to integrate well-defined processes with modern technology to scale efficiently and actually accomplish their missions.

Misconceptions About SOC Transformation and Modern Tools

Here, the discussion tackles the misconception that simply replacing legacy tools like SIEMs or deploying shiny, AI-powered products constitutes a SOC transformation. Anton criticizes the superficial approach of tech upgrades without process modernization, stressing that true transformation involves fundamentally rethinking workflows. The conversation also covers how modern detection methods should incorporate diverse technologies, rather than relying solely on EDR, which is often overhyped.

Federated vs. Centralized SOC Models: Advantages and Challenges

This section explores the concept of federated or sub-SOC models, where specialized teams focus on particular aspects like EDR, NDR, or IAM within a broader organizational structure. Danny explains that federation can offer benefits like specialization and localized operations but poses challenges in maintaining consistent visibility and correlation across tools and regions. The importance of integrating telemetry from different sources and avoiding silos is emphasized.

The Limits of EDR and the Need for Multiple Detection Layers

Anton and Danny debate the obsession with EDR as a primary detection tool, noting that no single solution can cover all attack surfaces, especially in modern, cloud-centric environments. They highlight that EDR often focuses on endpoints but misses broader attack vectors like network, identity, or cloud. The analogy of the immune system illustrates the need for multiple, diverse detection techniques to effectively identify and respond to threats.

The Role of AI in Detection and Data Management

This segment considers how AI could enhance security operations by linking signals from multiple tools, providing a full-stack view of attacks. Challenges include ensuring comprehensive data collection and accessibility across legacy and isolated systems. The discussion touches on whether AI will shift the balance between data centralization and federation, recognizing that vast data volumes demand smarter, not just more, approaches.

Telemetry and Metrics in Detection and Response

The conversation highlights the importance of metrics like mean time to contain (MTTC) and overall detection coverage to measure security effectiveness. Danny stresses that early containment is crucial, as it limits damage and enhances response efficiency. The discussion points to the need for better organizational metrics beyond traditional detection counts, focusing on containment and response times.

The Use of Excel for Tracking and Managing Security Incidents

Despite advances in technology, many security teams still rely heavily on Excel for managing detection cases and investigations due to its simplicity and familiarity. Danny suggests that this reliance might be rooted in comfort, legacy habits, or tool limitations, and advocates for better UI/UX designs on top of data stores to improve workflow efficiency.

Practical Advice and Future Directions in SOC Operations

The episode concludes with Danny emphasizing the importance of process focus over mere tool acquisition. He advises security leaders to clarify their mission, adopt proven processes, and leverage modern tech thoughtfully. For reading, he recommends enjoying books for their broader insights rather than purely technical materials, mentioning 'In My Time of Dying' as an example of how risk, triage, and science intersect in real life.

Show notes

Guest:

Daniel Lyman, VP of Threat Detection and Response, Fiserv

Topics:

What is the right way for people to bridge the gap and translate executive dreams and board goals into the reality of life on the ground?
How do we talk to people who think they have "transformed" their SOC simply by buying a better, shinier product (like a modern SIEM) while leaving their old processes intact?
What are the specific challenges and advantages you've seen with a federated SOC versus a centralized one? What does a "federated" or "sub-SOC" model actually mean in practice?
Why is the message that "EDR doesn't cover everything" so hard for some people to hear? Is this obsession with EDR a business decision or technology debt?
How do you expect AI to change the calculus around data centralization versus data federation?
What is your favorite example of telemetry that is useful, but usually excluded from a SIEM?
What are the Detection and Response organizational metrics that you think are most valuable?
Is the continued use of Excel an issue of tooling, laziness, or just because it is a fundamentally good way to interact with a small database?

Resources: