All About the Details: How Small Things Change Everything in a SOC

It has been said that one shouldn't "sweat the small stuff," but that isn’t true when it comes to your Security Operations Center (SOC). There, small details can ultimately make a big difference in keeping your organization secure and your team operating effectively.

In the 20+ years that Secureworks® has been operating an industry-leading SOC, we’ve observed and learned how the strongest SOC teams maximize efficiency and quickly embrace best practices even if they seem trivial at first. Below are three Security Operations (SecOps) tactics that can help your SOC become a well-oiled, threat-fighting machine.

For more in-depth suggestions and additional hacks be sure to read SecOps Hacks: 7 Small Ideas That Make a Big Difference for Cybersecurity Teams.

SecOps Hack #1: Document key findings thoroughly

A standardized process is key for documenting key findings within an incident investigation. As your SOC analysts perform their investigations, they can rely on the structured clarity of the key findings documented in the following sections:

A brief Incident Summary designed to provide a brief overview and the “who,” “what,” “where,” and “when” of the investigation.
A Technical Details section that covers the in-depth aspects of the investigation.
Your SOC Team Recommendations for how best to remediate the issues they uncovered during the investigation.
References that can be used to review or clarify sections of your key findings or other attachments.

Key findings provide crucial documentation that can lend insight to security challenges today and position your SOC for compliance audits, cyber insurance claims, and other activities in the future. You truly cannot “over document” when it comes to these important parts of a structured investigation.

SecOps Hack #2: Pick – and stick with – a naming convention

Your SOC team should follow a naming convention for all investigations, allowing for easier location and access of documentation and simpler filing of findings and results. This does not have to be fancy. Many SOCs have found success with a simple naming convention like:

<Date (YYYY-MM-DD)> - <Threat/Useful Name> - <Asset Hostname/IP>

So, for your SOC in 2022, that convention in a stolen credentials investigation could appear as follows:

2022-06-30 – Suspected Stolen Credentials – [email protected]

Following a consistent naming convention can help your team stay organized, delegate more efficiently, and complete investigations more quickly. By keeping your investigations carefully documented and organized, your team can delegate tasks and review past investigations and findings with greater ease.

SecOps Hack #3: Pay special attention to recommendations

Your Incident Summary and Technical Details are only pieces of the puzzle – but the recommendations are truly where the big picture comes into view. Sharpen your recommendations with the following practices:

Provide clear, comprehensive recommendations that focus on the investigation itself. Avoid tangents into threat origin stories, organizational history, or other parts that aren’t crucial to the recommendation itself.
Itemize remediation objectives and associated follow up for clarity and easy reading. Provide appropriate downstream consequences of applicable follow-up actions for your team.
Include reputable sources supporting your remediation plan(s), and avoid generic terms or language copied and pasted from past investigations’ documentation.

Your SOC may face unique challenges and overwhelming change every day, but with some reliable habits and structured practices, you can build resilience, expertise, and perseverance for the cybersecurity challenges you haven’t even faced yet. Better yet, these habits and practices are built into Secureworks Taegis XDR, so your SOC will be positioned to automatically identify and prioritize emerging threats and respond to immediate risks quickly and more effectively than ever.

Read the full white paper, “SecOps Hacks: 7 Small Ideas That Make a Big Difference for Cybersecurity Teams or learn more about Taegis XDR by visiting www.secureworks.com/taegis.