CFOtech Australia logo
Technology news for Australian CFOs and financial decision-makers
Story image

The state of the SOC: skills shortages, automation and gaining context remain a challenge for SOCs

By Contributor
Mon 10 Jan 2022

Article by ThreatQuotient APJC regional director, Anthony Stitt.

The security operations centre (SOC) has been on the front line facing the pandemic-induced escalation of cybersecurity threats in the past eighteen months. A 2020 study found that the average security operations team receives more than 11,000 alerts per day (the figure is likely to have grown in the intervening period).

While they were deeply engaged in responding to the crisis, SOC teams simultaneously faced the disruption common to all formerly office-based workers. They were switching to remote working and learning how to continue collaborating successfully with colleagues at a distance.

As SOCs consider the changes and challenges of the past year, there’s an opportunity to explore some of the factors that characterise the modern SOC and issues experienced in this crucial sector.

After collecting and analysing the views of security analysts and team managers from a broad spectrum of industry sectors, the following key findings have been put together as priorities for equipping SOCs for the future:

The cybersecurity skills shortage continues to bite

A continuing issue: the number one barrier preventing full utilisation of a SOC’s capabilities is a lack of skilled staff. 

Supporting in-house skills development should be a key priority for SOC leaders. It doesn’t just improve SOC performance but also encourages staff to remain long-term with the organisation. The most common tenure for a SOC analyst is between one and three years, but training opportunities and career development are the key factors that encourage employee retention.

There are further benefits to growing your own expertise. For example, the top “missing skill” in teams was threat hunting experience, which can be costly to bring in from outside. Threat hunting and intelligence monitoring are the activities most commonly outsourced by the SOC. Yet, these are two areas where intimate knowledge of internal systems and infrastructure considerably improves effectiveness.

Suppose analysts can acquire these skills and are supported with tools that lift the burden of intelligence assimilation. In that case, this will amount to a double benefit for the business: they retain key staff and build stronger internal capability in the areas that would most benefit.

Work from home becomes the norm

Linked to the challenge of staff retention are changes to the work environment. Unsurprisingly, 87% of security analysts and team leaders surveyed said that working from home was permitted in their organisation. It may have raised some issues around how to collaborate effectively, but the general success of remote working has liberated SOC analysts.

Where previously they may have looked for employment within an easy commute, now they can search further afield. This means organisations will have to work harder to attract and retain employees and gives analysts greater leverage over pay and working conditions.

This should lead to a greater focus on analyst workload, which is long overdue. Currently, organisations lack an appropriate method of calculating analyst workload. The majority of survey respondents say their SOC doesn’t calculate it, and the next most common answer is that they use a basic time-per-ticket method. With 83% of SOCs operating 24/7 and most of these delivering this capability through in-house resources, managing workload is important to maintain team wellbeing.

As the workforce embarks on the “great resignation”, all the above factors should sound warning bells alerting employers that they need to develop and protect their employees if they want to retain them.

Automation and data context drive efficiency and security improvements

Another efficient way to mitigate the impact of escalating workloads on the SOC is through automation and orchestration, and here teams are also struggling. Automation and orchestration were only just behind skills shortages as the most significant challenge facing SOCs.

When you are short of staff and skills, mundane, repetitive and low-value tasks must be automated as far as possible, freeing analysts to focus on higher-value activities that reduce time to detection and response and are more individually fulfilling. It also supports teams to meet performance objectives and handle the escalating volume of alerts.  

Some quick wins can be implemented here. For example, one respondent has successfully deployed a portal integrating dozens of data sources which enabled consolidation of information from across the business. This resulted in a reduction in Level 0 to Level 2 response times by 25%. 

A number of respondents cited the lack of context related to the data they are seeing as a major barrier to operating an efficient SOC. The SOC of the future will be increasingly data-driven, ingesting information from multiple sources within and outside the enterprise, but data without context or relevance simply overwhelms analysts. 

Supporting the SOC of the future

As SOCs look to the next phase, focusing on people, data, and the technology that enables the two to work effectively together is key. By balancing automation to allow machine-based support where possible, together with the proper tooling for human analysts, SOCs can drive improvements while keeping analysts engaging and giving them more time to upskill into key areas such as threat hunting.

Related stories
Top stories
Story image
Employment
Tech job moves - Forcepoint, Malwarebytes, SolarWinds & VMware
We round up all job appointments from May 13-20, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Vectra AI
Understanding the weight on security leader’s shoulders, and how to shift it
Millions of dollars of government funding and internal budgets are being funnelled into cybersecurity to build resilience against sophisticated threats, indicating how serious this issue has become.
Story image
Cybersecurity
More than 40% of banks worried about cloud security - report
Publicis Sapient's new report finds security and the lack of cloud skills and internal understanding of business benefits are big obstacles for banks moving to the cloud.
Story image
Ransomware
Alarming surge in Conti Ransomware Group activity - report
A new report has identified a 7.6 per cent increase in the number of vulnerabilities tied to ransomware in Q1 2022.
Story image
Digital Transformation
Unlocking the next digital frontier for educational institutions
Understanding where to invest in technology can be challenging for education institutions, especially after the COVID-19 disruptions.
Story image
Safety
Voxel hits total funding of $18M following ongoing wins
Since raising its seed round in September, Voxel has grown at pace, by decreasing on-site injuries by upwards of 80% and increasing operational productivity.
Story image
Infrastructure
Nutanix study reveals financial services sector lagging with multicloud adoption
Nutanix has released new research that reveals the financial services sector is lagging behind when it comes to multicloud adoption.
Story image
Remote Working
How organisations can meet employees' changing expectations
The global employment market has shifted dramatically in favour of employees, sparking the so-called great resignation, in which people are leaving unsatisfying roles in search of greener pastures.
Story image
Digital Transformation
The Huawei APAC conference kicks off with digital transformation
More than 1500 people from across APAC have gathered for the Huawei APAC Digital Innovation Congress to explore the future of digital innovation.
Story image
Alteryx
Decision Inc. Australia enters partnership with Alteryx
Independent data and analytics consultancy Decision Inc. Australia has partnered with automated analytics company Alteryx, expanding its offering to clients.
Story image
Sisense
Data and analytics could be key to higher selling prices in APAC
Sisense's latest report has found that almost half of data professionals in APAC think customised data and analytics can create better selling prices for their products.
Story image
Adyen
Adyen expands partnership with Afterpay as BNPL payments increase
Adyen has expanded its partnership with AfterPay allowing more of Adyen’s merchants in more countries worldwide to use the BNPL provider.
Story image
Testing
Google and CSIRO use AI to help protect the Great Barrier Reef
Google has partnered with CSIRO in Australia to implement AI solutions that help protect the Great Barrier Reef.
Story image
Ransomware
A third of companies paying ransom don’t recover data - report
Veeam's report finds 76% of businesses who are victims of cyberattacks paid the ransom to recover data, but a third were still unable to get their information back.
Story image
Digital Transformation
Trading up: It's time to swap core systems for flexible digital applications
This year will see more oranisations planning and commencing high tech renovations that will shake up the way they operate.
Story image
Digital Transformation
Why enterprise records management should be part of any digital transformation strategy
Modern organisations create and rely upon an enormous volume of content, and digital records make up a significant proportion of that content.
Story image
Remote Working
IT teams deploy powerful technologies to enable remote work
"We found that IT teams mastered the challenges of remote work last year in large part by employing powerful yet easy-to-use technologies."
Story image
Public Cloud
Cloud adoption still a work in progress, NetApp finds
NetApp has announced the results of the annual Cloud Infrastructure Report based on a survey of public cloud business and IT decision makers.
Story image
SaaS
Cloudflare launches instant serverless database for dev teams
"Today we’re announcing our first serverless database which we expect will quickly become one of the largest databases in the world."
Story image
Microsoft
Microsoft unveils adaptive accessories for disability access
Microsoft is introducing an expansive Inclusive Tech Lab to give people with disabilities greater access to technology through new software features and adaptive accessories.
Exabeam
Find out how a behavioural analytics-driven approach can transform security operations with the new Exabeam commissioned Forrester study.
Link image
Story image
Telstra
Telstra, Google and Accenture launch 5G AR experience for AFL
Telstra, Google and Accenture are developing a new 5G powered augmented reality (AR) experience at Melbourne's Marvel Stadium for the footy season.
Story image
Customer experience
Research unveils precarious customer loyalty for retailers
New research has found customers are reassessing established brand loyalties as their priorities and behaviours shift.
Story image
Excel
Could your Excel practices be harming your business?
While Excel has been the de-facto standard for budgeting, planning, and forecasting, is it alone, enough to support organisations in the global marketplace that’s facing rapid changes due to digital transformation?
Story image
Fintech
Airwallex launches new bank feed integration with NetSuite
Airwallex has launched a new bank feed integration with NetSuite, developed in partnership with NetSuite solution partner, Onlineone.
Story image
Tech job moves
Tech job moves - Datacom, Micro Focus, SnapLogic and VMware
We round up all job appointments from May 6-12, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
VPN
The most common online scams in Australia
No one is safe from online scammers, and many of these scammers have capitalised on the pandemic, using this confusing time to attack more people than ever.
Story image
SAS
New SAS service overcomes subscription fatigue for media companies
SAS has launched SAS 360 Match which helps media companies move towards a AVOD model to generate revenue as subscribers cancel.
Story image
Phishing
Google reveals new safety and security measures for users
Google's new measures include automatic two step verification, virtual cards and making it easier to remove contact information on Google Search results.
Story image
Artificial Intelligence
Clear Dynamics closes $35M funding round, invests in global growth
The funding is a major milestone and speaks to Clear Dynamics’ vision for AI-enabled ‘composable’ enterprise software, the company states.
Story image
Artificial Intelligence
ForgeRock releases Autonomous Access solution powered by AI
ForgeRock has officially introduced ForgeRock Autonomous Access, a new solution that uses AI to prevent identity-based cyber attacks and fraud.
Story image
Sift
Sift shares crucial advice for preventing serious ATO breaches
Are you or your business struggling with Account Takeover Fraud (ATO)? One of the latest ebooks from Sift can provide readers with the tools and expertise to help launch them into the new era of account security.
Story image
Artificial Intelligence
SAS unveils AI experience to improve kids' batting abilities
SAS has created The Batting Lab, an interactive experience using AI, computer vision and IoT analytics to help kids improve their baseball and softball swings.
Story image
Mobility
Hands-on review: STM laptop bags
The advent of hybrid working has meant we need laptop bags. We got our hands on two of the most popular laptop bags from STM.
Story image
Attain
Revenue operations is taking centre stage
As the business world continues to evolve, new demands need to be met to keep up with the ever-changing landscape. 
Story image
Artificial Intelligence
SAS launches human-focused responsible innovation initiative
SAS has launched a responsible innovation initiative, furthering its commitment to equity and putting people first.
Story image
SaaS
Atturra partners with Focus HQ to support Aus organisations
Atturra has executed a partnership agreement with Focus HQ, to resell and support the company's Australian developed SaaS-based portfolio management platform.
Story image
Artificial Intelligence
SAS announces new products amid cloud portfolio success
Analytics and AI company SAS is deepening its broad industry portfolio with offerings that support life sciences, energy, and martech.
Story image
Manufacturing
HINDSITE wins Aerospace Xelerated Pitch Challenge with solution to support Boeing
Brisbane-based startup HINDSITE was the winner of the first ever Pitch Challenge organised by Aerospace Xelerated in partnership with Queensland XR Hub. 
Story image
Artificial Intelligence
Updates from Google Workspace set to ease hybrid working troubles
Google Workspace has announced a variety of new features which will utilise Google AI capabilities to help make hybrid working situations more efficient and effective.
Story image
Data Protection
Barracuda launches new capabilities for API Protection
"Every business needs this type of critical protection against API vulnerabilities and automated bot attacks," Barracuda says.
Story image
Remote Working
Australia’s remote workers face connectivity and security issues
SOTI's new report finds better video conferencing technology and improved security measures are top concerns for remote workers in Australia.
Story image
Wasabi Technologies
Wasabi opens new cloud storage in Australia with Equinix
Wasabi Technologies has opened a new hot cloud storage region in Sydney, Australia, using Equinix services. This is the company's 12th global storage region.
Story image
Microsoft
SAS Viya on Microsoft Azure to deliver 204% return - study
The Forrester Total Economic Impact study finds SAS Viya on Microsoft Azure brings a 204% return on investment over three years.