![\"Elements](\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/01\/image1.png\")
<\/span><\/div><\/p>\nIn our extensive work with security teams around the world, we\u2019ve seen the best and the worst security operations (SecOps) practices. Despite a wide range of cybersecurity strategies and investment levels, we\u2019ve found that most enterprise security programs have lots of room for improvement to better prevent, identify, investigate and mitigate threats with speed and confidence. Even mature Security Operations Centers (SOCs) commonly struggle with alert fatigue, staffing turnover, and complicated manual processes, all of which take away valuable time that they could be spending on investigations and process optimization.<\/span><\/p>\n The first measure to make meaningful improvement is to take a step back and do an honest evaluation of how your security operations are structured and how they\u2019re serving your business goals. <\/span><\/p>\n To help with this evaluation, we\u2019ve condensed the considerations that go into building efficient and scalable security operations into six fundamental pillars. Each of these pillars contain a number of building blocks that we describe in-depth in our book, \u201c<\/span>Elements of Security Operations<\/span><\/a>.\u201d By evaluating your security operations against each of these pillars and their building blocks, you can assess your capability gaps and evolve your security operations to provide better and faster prevention and remediation.\u00a0<\/span><\/p>\n The Business pillar defines the business objectives and management strategies of the security operations team. Business questions that must be answered:<\/span><\/p>\n The People pillar defines the humans who will be accomplishing the goals of the security operations team and how they will be managed. Questions that must be answered:<\/span><\/p>\n The Interfaces pillar defines what functions need to be involved to achieve the stated goals. Security operations is not a silo and needs to work with many other functions of the business. We describe each of these interactions as \u201cinterfaces,\u201d and these should be defined so expectations between groups are clearly stated. Each group will have different goals and motivations that, when understood, can help with team interactions. Identifying the scope of responsibility and separation of duties will also reduce friction within an organization. Questions that must be answered:<\/span><\/p>\n The Visibility pillar defines what information the SecOps function needs access to. This includes security and systems data, as well as knowledge management content and communications through collaboration tools. Questions that must be answered:<\/span><\/p>\n The Technology pillar defines what is needed to achieve visibility into the information needed in the security operations organization. It is important to note that each element should not be thought of as a different tool but rather a capability that should be achieved with the given technology stack. Technologies and capabilities change rapidly, so these are the most fluid elements of a security operations team.<\/span><\/p>\n There is a glut of siloed tools in the industry that lead to a variety of issues, including extensive vendor management, limited feature use, duplicate functionality, and sometimes, end-user degradation. We\u2019re seeing a shift, with organizations moving away from best-of-breed siloed tools toward platforms that provide capabilities needed in the SOC without the need for installation and maintenance of different tools. Questions that must be answered:\u00a0<\/span><\/p>\n The Processes pillar defines the processes and procedures executed by the security operations organization to achieve the determined mission. Questions that must be answered:<\/span><\/p>\n By answering the questions from each of the above pillars, you will have an outline to assist in the improvement of your SecOps functions. For additional analysis of the considerations that go into each of these questions, <\/span>download a free copy of our book, \"Elements of Security Operations<\/span><\/a>.\"<\/span><\/p>\n Watch for future posts in Kerry Matre's series<\/a> on \"Elements of Security Operations.\" Next up: \"Do Your SOC Metrics Incentivize Bad Behavior?<\/a>\"<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" Take a step back and do an honest evaluation of how your security operations are structured and how they\u2019re serving your business goals. <\/p>\n","protected":false},"author":432,"featured_media":104830,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6770],"tags":[6980,673],"coauthors":[4695],"class_list":["post-104827","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-the-future","tag-elements-of-security-operations","tag-security-operations-center","sec_ops_category-must-read-articles"],"jetpack_featured_media_url":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/01\/image1.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/104827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/432"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=104827"}],"version-history":[{"count":9,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/104827\/revisions"}],"predecessor-version":[{"id":105690,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/104827\/revisions\/105690"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/104830"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=104827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=104827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=104827"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=104827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}1. Business<\/h2>\n
\n
2. People<\/h2>\n
\n
3. Interfaces<\/h2>\n
\n
4. Visibility<\/h2>\n
\n
5. Technology<\/h2>\n
\n
6. Processes<\/h2>\n
\n