Name: Designing an Effective SOC - Part II How to Build an Efficient & Effective SOC
Start: 2020-04-16T15:15:00Z
End: 2020-04-16T15:15:41.000Z
Location: BrightTALK
Rating: 0

Respond Software is the cybersecurity investigation automation company and creator of the Respond Analyst, an XDR engine built to accelerate investigations for security operations teams. Defense agencies, government bodies, universities, large enterprises, and leading managed service providers use the Respond Analyst to get investigation power at machine speed. The Respond Analyst works with the broadest range of vendors, sensors, threat intelligence and data repositories in the industry to improve detection and response while raising security analyst productivity. Since its founding in 2016, Respond Software has partnered with more than 100 customers to apply data science to help security operations defend their enterprise. www.respond-software.com.

XDR is a relatively new term in the security tools landscape. It stands for Extended Detection and Response – the approach that security operations centers should extend visibility and analysis to include threat intelligence, telemetries, vulnerabilities, and other relevant IT information. XDR is built to accelerate detection and response and reduce security engineering headaches that plague security operations teams.  

What are the challenges with current approaches to detection and response? Should you displace your current SIEM? What about the cloud? 

Let’s talk about it. Join Respond Software as we host a live chat with Dave Gruber, Senior Cybersecurity Industry Analyst, from ESG. Dave will discuss the key findings from the latest industry research on XDR in the ESG eBook, The Impact of XDR in the Modern SOC. Hosted by Mike Epplin, Solutions Architect, get the definitive roadmap for everything you need to modernize the SOC. 

We will explore why XDR is so important for security teams to address today’s advanced attacks, how organizations are approaching XDR implementations, and what core outcomes can be expected. If you are evaluating XDR, join us here on BrightTALK on December 2 at 11 am ET. You don’t want to miss it!

Source: ESG eBook, The Impact of XDR in the Modern SOC – Taking Detection and Response to the Next Level, November 2020.

Survey Says: A Modern SOC Requires XDR

From COVID to the cloud and from ransomware to work-from-home, everything changed, fast. The foundation of it all – the Security Operations Center, or SOC, played a critical role in supporting how enterprises tackled the pivot in how we work, communicate and connect, while ensuring a strong security posture for the organization. The Ponemon Institute researched how these changes have impacted the effectiveness of the SOC in the “Second Annual Study on the Economics of Security Operations Centers: What is the True Cost for Effective Results?” 

What stands out this year? 

•	COVID-19: The pandemic’s impact on how SOCs operate and tackle security challenges as remote employees create new access points and bad actors take advantage. 
•	Strong Hiring & Salaries: Jobs and salaries are up as CISOs drive to employ qualified security analysts and retain them in an environment where competition for their services is ruthless. 
•	ROI of the SOC is Dropping: Complexity, analyst turnover and the growing cost of MSSP support for security monitoring drives lower scores in SOC investment.
•	Budgets include Automation & Extended Detection & Response: Extended Detection & Response (XDR) and security automation solutions have emerged as budgetary priorities as CISOs seek answers to improve security engineering effectiveness and cost.

Let’s dig into what it all means for the next year. Join the report author, Larry Ponemon, Founder of the Ponemon Institute and Dan Lamorena, VP of Marketing for XDR at FireEye, for a live discussion on the state of today’s SOC, staffing, budgets for SOC tools, cost considerations for outsourcing and ROI.

The Security Operations Center is Essential – But Is it Effective?

The security operations center (SOC) will never keep up with information overload. CISOs are challenged to transform the paradigm so the investments in people payoff, while reducing attrition and making security work fun. Automation is only just part of the solution.

Modern security operations need to abandon the current model bogged down by formalities in process and procedure to one that is incident-aware, and situation focused. As enterprises deploy solutions for endpoint detection and response (EDR), security teams are realizing that they also need tools and strategies that are more all-encompassing to include threat intelligence, cloud services, SOAR, and next-gen SIEM, among others. So, where is the SOC to go from here?

Join Chris Triolo, Chief Customer Officer at Respond Software, as he welcomes Jackie Groark, VP of Security and CISO at Veristor. Triolo and Groark will explore the promise of Extended Detection and Response (XDR) and start a discussion on how to supercharge automation and effectiveness in the security operations center.

To XDR or Not to XDR?

Security analysts are the detectives of the Security Operations Center; investigating suspicious alerts and events, corroborating related evidence from multiple sensors, threat intelligence, and company context. The security analyst position is pivotal, yet they still face manual challenges of connecting pieces of evidence; having to chase false positives, or pivoting between different consoles. In the likeness of how the evidence board enables detectives to collect and connect evidence from a crime, XDR solutions enable our security detectives to detect, investigate and respond to incidents more efficiently and effectively. An open XDR works with the best-of-breed security telemetries to correlate the probability of a security event being malicious and actionable. Security analysts receive a fully scoped investigation, from the first suspicious alert through the entire malicious scenario that occurred in the environment, all mapped to the MITRE ATT&CK Framework.

The Respond Analyst is a simple, open, and intelligent XDR Engine:

 - Simple – cloud-native and deploys in hours without coding or content writing
 - Open – vendor-agnostic integrations modernize the sensor grid, no rip & replace
 - Intelligent – powered by Integrated Reasoning, the combination of data science and automated analysis from multiple sources determines the 
                       likelihood of an event being malicious and actionable

Join Mike Epplin, Solutions Architect, for the technical Q&A and on-demand demo of the Respond Analyst, an XDR Engine.

Investigate Security Incidents at Machine Speed

The Respond Analyst investigates, scopes, triages, and correlates events, increasing the incident remediation capabilities of Phantom. The combination of the Respond Analyst and Phantom will result in reduced attack dwell time for customers that have or are considering the use of both solutions.

Learn how The Respond Analyst & Phantom integrate together to streamline incident remediation.

Detect & Remediate Incidents Faster with XDR & SOAR

eXtended Detection and Response (XDR) solutions offer unified security sensor integrations that enable the Security Operations teams to respond to threats more effectively and efficiently. They promise streamlined incident detection and less security engineering costs than SIEM or SOAR solutions. So, how do security leaders find the best XDR solution for their enterprise?  

In this live webcast, Marilyn Littell, VP of Software Solutions, and Jeff Smith, VP of Digital Transformation Technologies at IIS, discuss the key considerations for evaluating the operational and business costs/benefits of implementing an XDR solution.

Joined by guest, Dan Lamorena, CMO of Respond Software, this interactive discussion will focus on answering these three questions:
 
1. What are the key benefits of an XDR, and do we need them?  
2. What is beneath the hood in an XDR, and will it effectively find real events in our environment?
3. What are the considerations we should have when building out a shortlist of vendors?

What is XDR and How Will it Impact the SOC?

Security analysts are swimming in a sea of alerts. They end up staring at screens and multiple consoles instead of focusing on the real cyber detective work of finding attackers. Current SOC tools only fill in some of the blanks and require constant tuning and maintenance. There is a better way.

Chris Calvert, SOC builder and co-founder of Respond Software, has helped many organizations change their reactive SOC posture to a proactive approach of finding the bad guys. Watch the on-demand webinar to hear from Chris about the new XDR (Extended Detection and Response) product category and how organizations are deploying XDRs to detect and respond to attacks faster at a fraction of the cost.

Connect the Dots of Your Security Evidence | The Role of XDR in the SOC

Security leaders often get caught up in the chase for the newest technology investments but may struggle to maximize the cybersecurity operations budget. So, how do you ensure you are selecting the right tools to optimize your security spend?

Join Respond Software as we host a live chat with Brett Wahlin, CISO of Amazon Prime Video. Brett will share the best practices he applied to lead security operations at a number of organizations, including Staples, HP and Sony. Hosted by Chris Triolo, VP of Customer Success, get the definitive roadmap for everything you need to maximize your security operations budget. 

This live chat will answer how to:

- Identify the big security budget categories for CISOs
- Justify spend on new technologies and evaluate solutions to find the right fit
- Build ROI models for cybersecurity
- Shift budget between CapEx and OpEx
- Support organizational shifts to support new priorities
- Capture the biggest opportunities for cost savings

You don’t want to miss it!

Security Leaders: Optimize Your Security Operations Budget

As the cybersecurity threat landscape becomes more complex, organizations are struggling to keep their data and applications secure. Many are considering the use of Managed Security Service Providers (MSSP) to help them address the myriad of security issues and events they are tasked to manage. However, finding the right MSSP partner is not always a straightforward or simple endeavor. 

Organizations must consider many alternatives when deciding on an MSSP, including:
-What are the typical cybersecurity challenges that small to medium businesses face and how are they being addressed by MSSPs?
-How can these organizations afford to hire an MSSP within the constraints of a tight budget?
-What attributes do organizations need to consider when evaluating an MSSP and what kinds of benefits should an organization expect from them?
-What does a next-gen MSSP look like and why is that important?

Join this webcast and learn how CyberPeak and Respond Software are answering these key questions in helping you find the right cybersecurity partner for you.

What is a Next Generation MSSP?

Recorded on August 20th, National Radio Day. 

Catch the play-by-play of how security events go from a single sensor alert to an actionable, investigated critical incident. Mike will share how his customers are empowering security analysts to respond faster to critical security incidents with software:

- Consolidating disparate security sensor data
- Reducing the time wasted chasing false positives
- Automating the scoping, escalation, and investigation of security alerts

SOC Automation at the Speed of Software

The MITRE ATT&CK Framework has become the standard knowledge base for helping Security Operations Centers (SOC) manage threats and malicious activity.  However, as organizations leverage and adopt MITRE, SOCs continue to struggle with the detection of real and malicious activity threatening their environments.      

Respond Software offers the Respond Analyst, a fully automated monitoring, detection and investigation solution that is providing SOCs with comprehensive visibility and control  in relation to the MITRE ATT&CK Framework.  Join this webcast to learn how the Respond Analyst is leveraging the MITRE ATT&CK Framework to:

•Detect threats using “integrated reasoning” from multiple security sensors
•Reduce or eliminate the need to chase false positives
•Scope multiple events into a manageable number of incidents that SOC teams can remediate

This webcast will also feature a live demonstration.

Finding Real Security Threats in Your Data within the MITRE ATT&CK Framework

Endpoint Detection and Response (EDR) provides security organizations with highly accurate, detailed, low-level OS information, by way of 10s of thousands of events per day. EDR is a key piece for optimal security posture, however, monitoring requires deep OS and security expertise to achieve a quick and effective response. Many organizations have Tier 1 analysts swiveling between consoles, generating manual queries, and incorporating other context and security events; a method that often leaves security teams with more alerts than they can manage.  

By automating the monitoring & triage of EDR events with Robotic Decision Automation (RDA), security teams can focus on their response actions and other areas that reduce business risk. 

In this session, you'll learn how Respond Software uses RDA to enhance EDR data by:

- Monitoring attacks in realtime 
- Eliminating false positives using probabilistic models
- Leveraging multiple security data sources and automated analysis

Automating SecOps - Monitoring & Triage for EDR Events

The cybersecurity threat landscape is increasing – 238% increase in cyber incidents, ransomware attacks are saturating the network, and hacktivism is reaching new heights. As business complexity takes on new forms, how can security leaders reduce risk for their organizations? 

Modern security operations is set for a transformation. Join this webinar to learn:

•	How to employ a human-first approach in the SOC, driving human resilience to empower security analysts to work smarter, not harder
•	Why artificial intelligence (AI) and machine learning (ML) are not silver bullets for the modern SOC
•	How to assess the right tools to level-up security monitoring
•	Questions you need to ask today to transform your cybersecurity investments for tomorrow

Register today for a spirited and informative discussion that will guide participants to close the gap on security incidents, remove uncertainty and add confidence to decision-making.

Reset Modern SecOps for Stability, Resilience, and Growth

Today’s SOC models provide two options: build a labor-intensive in-house SOC or outsource to an MSSP. In Part-1 of this two-part series Larry Ponemon shared how dissatisfied security professionals are with the inefficiencies found in both models. Now in Part II, Chris provides a practical guide for designing a new modern SOC model that combines humans and machines to deliver more efficiency and ROI.  

In this talk we’ll discuss:
*Blueprint for designing a modern SOC
*Using software to increase efficiencies and improve morale
*Covering more event data without breaking the bank
*Validating ROI to senior executives and the board

Designing an Effective SOC - Part II How to Build an Efficient & Effective SOC

Cyber Security

Cyber Defence

Cloud Security

Threat Hunting

IT Security

Information Security

SecOps

Automation

Incident Detection

Security Operations

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Designing an Effective SOC - Part II How to Build an Efficient & Effective SOC

Presented by

About this talk

More from this channel