In recent years, various cyber-attacks have plagued various businesses and
organizations with increased frequency and sophistication. These attacks
have ranged from denial of service attacks, SQL injection, and brute force
attacks to ransomware attacks. They afflict organizations of various sizes,
from small and medium enterprises to big organizations. The cost of cyber-
attacks may run into millions of pounds, compromised privacy, and lost man
hours. As a result, “businesses and government agencies are implementing
security information and event management (SIEM) systems to better secure
their employees and the public” [1].
Due to the impact of cyberattacks, every organization with digital assets
needs to have a security plan for monitoring their infrastructure to detect
intrusions and an incident response plan. According to the National Institute
of Standards and Technology (NIST) cybersecurity framework core, “the five
concurrent and continuous functions - Identify, Protect, Detect, Respond,
Recover - provide a high-level, strategic view of the lifecycle of an
organization’s management of cybersecurity risk” [2].
A security operations center (SOC) can help implement and meet the five
functions of the NIST CF core. It is a centralized function within an
organization that employs people, processes, and technology to continuously
monitor and improve its security posture while preventing, detecting,
analyzing, and responding to cybersecurity incidents [3]. According to NIST,
a cybersecurity incident is “a violation or imminent threat of violation of
computer security policies, acceptable use policies, or standard security
practices” [4].
It is important to note that the duties of a SOC involve monitoring, detecting,
and responding to threats. However, there are scenarios where organizations
do not have a SOC, or the SOC may be missing key capabilities such as
responding to security incidents. The reasons for this vary from the cost of
security solutions to the unavailability of a workable and scalable SOC
architecture.
This paper presents a SOC architecture with incident response capabilities
that uses open-source, free, or low-cost solutions. The architecture has a low
barrier to entry and the ability to scale horizontally in the event of business
growth. It is intended for small and medium businesses. The architecture
includes automated incident response capabilities and mapping for
personnel to man the SOC tools and platforms.
The preceding sections of this paper examined the background of the
problem of architecting scalable security operation centers with incident
response capabilities. Section 2 presents background information, literature
review, and analyses of what a security operations center is. Literature from
various authors on SOC design and incident response is reviewed to flesh out
frameworks for building the SOC architecture. Section 3 lays out the research
methodology and the materials used in this paper. Section 4 analyses the
results of the implementation of the proposed architecture, and then
conclusions and recommendations for future research on this topic are
provided in Section 5.
The primary mission of the Security Operations Center (SOC) is to defend the
enterprise against breaches and attacks, keep enterprise assets (e.g., data,
applications, infrastructure) secure, and facilitate normal functioning around
the clock (Palo Alto Networks, 2020). According to SANS Institute, "a SOC is a
combination of people, processes, and technology protecting an
organization's information systems through proactive design and
configuration, ongoing monitoring of system state, detection of unintended
actions or undesirable state, and minimizing damage from unwanted
effects."
SOC is the central point of the enterprise to collaborate and coordinate
efforts in monitoring, assessing, and mitigating malicious activities (Check
Point, n.d.). The operational focus of SOC is security incident detection,
analysis, and response. Johnson (n.d.) described the SOC as the heart of any
security organization, and its essential functions are monitoring, analysis,
and response. According to Johnson (n.d.), the proposed SOC framework is
based on five core principles: (1) monitoring, (2) analysis, (3) incidence
response and containment, (4) auditing and logging, and (5) threat hunting.
With increased digital transformation, the attack surface for enterprises has
been growing tremendously. With the rise of advanced persistent threat
(APT), attackers have been deploying complex and cutting-edge technologies
to discover and exploit vulnerabilities in systems and networks, resulting in
the exponential growth of cyberattacks, including zero-day ones.
Furthermore, enterprises adopted mobile and cloud technologies, making
traditional perimeter-based cyber defense less effective (Knerler et al.,
2022). Despite all defensive security postures, organizations are prone to
cyberattacks and security breaches, negatively impacting normal operations
supporting missions. Due to security breaches, companies lose valuable
data, including personally identifiable information (PII) about customers and
employees. Therefore, the security operations center must adopt cutting-
edge technologies to disrupt and identify attacks and mitigate security
incidents.
The SOC system continuously monitors digital activities, and the enterprise
infrastructure security prevents and detects malicious activities (Lindstrom,
2018). In some cases, it takes the appropriate actions automatically.
Additionally, security analysts must review the system-generated alerts and
take proper steps to prevent and respond to attacks already underway. The
suitable machine learning algorithms utilize large volumes of collected data
and identify anomalies and attacks as part of SOC systems, like Security
Incident and Event Management (SIEM) (Sathana & Memamalini, 2022).
Once threats and attacks are identified, Security Orchestration, Automation,
and Respond (SOAR) can take appropriate action to mitigate the threats and
attacks (Oesch et al., 2020). With the adoption of technologies, various
devices, software, and cloud services (e.g., IaaS, PaaS, SaaS, etc.) and the
exponential growth of sophisticated adversaries and cyber threats (Kumar et
al., 2021), the security operation center must monitor inbound and outbound
traffic to prevent, detect, respond and recover from any security indents
(Yeshwanth et al., 2022). To identify cyber threats and attacks, SOC must
gather data across the enterprise and perform real-time analysis of massive
volumes of data from logs (e.g., network firewalls, web firewalls, network
sensors, endpoints, etc.), intrusion detection and prevention systems,
identity and access management systems, threat intelligence feeds, and
numerous other sources.
With traditional technologies and methodologies, analyzing large volumes of
data to identify threats and attacks is challenging (Kim et al., 2020).
Furthermore, conventional methods generate many alerts that overwhelm
the security operations center analysts to prioritize them and take the
appropriate remediation actions (Farooq & Otabi, 2018). Therefore, the SOC
needs the capability to analyze large volumes of data in real-time or near
real-time, identify attacks and breaches, and take corrective measures.