Magazine menu Close Magazine menu

security operations center

Latest stories

Futuristic-looking car drives along while broadcasting much data into the world

This will defend your automotive business against next-gen cyberattacks

  • min read
    • Cars are more connected than ever before: Onboard music streaming, GPS maps beamed to vehicles via the internet of things (IoT) – they're computers on wheels becoming more digitized. Traditional automotive manufacturers are transforming their business models to reflect this, with technologies like in-vehicle online marketplaces. As the automotive industry evolves towards fully autonomous vehicles, security becomes harder to control. But security must be active throughout the car's lifecycle. Make no mistake, security breaches can be fatal and costly. If you're manufacturing vehicles with connected capacity, a Vehicle Security Operations Center (VSOC) can increase protection for your business, fleet and customers against cyberattacks. First, let's explore the changing landscape and its risks. Connected cars are easy targets for remote hackers and terrorists Operating systems in connected vehicles aren't just a personal data goldmine – with audio files recorded by in-car microphones to stored bank details and even Netflix and Spotify credentials leaked on eBay – but they can also control vehicle movement. If a hacker remotely hijacks the operating system of one of your vehicles or even your whole fleet, the consequences could be devastating. Whether it's taking control of a Tesla's brakes, door locks and other electronics, or exposing personal data like Mercedes-Benz – hackers do and will find vulnerabilities in connected vehicles. But why? Terrorists looking to cause fatal chaos. Hackers out for financial gain (they may shut the engine down and demand payment to start it again.) Even mercenaries spying on executives – think how valuable audio files of confidential merger plans would be to rivals. What is a Vehicle Security Operations Center? A Security Operations Center (SOC) is a team that deals with security issues at an organizational or technical level. In most cases, the team uses a platform dedicated to constant monitoring of the organization's IT infrastructure. A Vehicle Security Operations Center (VSOC) is the same, but as well as protecting computers and servers, it also protects assets like connected vehicle cloud and fleet management system (which send and receive messages to and from vehicle's telematics control unit) and the vehicles themselves, mobility servers (phones connected to vehicles) and vehicle internal components like sensors and radars. Two audiences need VSOCs: Automotive manufacturers (like Mercedes or Tesla) and large fleet owners (like logistics companies or taxi firms.) It minimizes the risks of cyberattacks and, in the event of a breach, triages and treats the cyber-wound. It can also give unwavering diagnostics of your entire fleet (great for ongoing and predictive maintenance) and a wealth of information on how your cars are used, like time and distance traveled, Wi-Fi strength or errors in the engine performance. Perfect for R&D for new models. But how do you implement a VSOC? VSOC: To in-house or outsource? There are two ways to create your VSOC: In-house or outsource. In-house means integrating the unit into your current operations, either within your cybersecurity operations, quality assurance or the vehicle software R&D team. On the other hand, you could outsource part or all of the VSOC to a third-party provider. In some instances, this may be helpful to start with, as you may not yet have the cybersecurity infrastructure and expertise. A full VSOC may be out of scope for a small fleet owner, but if you run a large fleet or you're an automotive manufacturer, in the long term, it will be most beneficial to your business to establish your VSOC internally. How to launch your VSOC Here are some tips to get started: Create a playbook Security experts should create incident response playbooks (guidelines) to show how you would respond to specific cyber-threats and how to manage incident communications. Expand your team's knowledge Many cybersecurity teams focus on server infrastructure, not connected vehicles. Implement advanced cybersecurity training to develop the skills of your current team. For example, Kaspersky Cybersecurity Training covers malware analysis, digital forensics and incident response to help a specialist enterprise-level team better face these threats. Funnel issues straight to your VSOC Establish a system to escalate vehicle monitoring and diagnostics when needed, so in the event of a breach, it's sent straight to the cybersecurity teams. Regular security assessments Periodically conduct security assessments of your connected car's infrastructure, both the separate modules (like TCU and mobile apps) and also test how the complete system works together. Share these results with your VSOC team. Maximize data capture Investing in onboard vehicle software, like intrusion detection systems, will feed your VSOC with vital information to detect anomalies and other signs that could lead to data breaches. Enrich your VSOC with threat data feeds from at least two security vendors. There are public feeds available, but licensed feeds are typically better quality. Use white-hat hackers Make use of the global community of white-hat hackers. These are friendly hackers, trained professionals who find vulnerabilities and make sure your systems are bulletproof. And if they're not, they'll give you the diagnosis to fix them. You could also join the likes of BMW and Tesla and launch a Bug Bounty program, which pays people (professional and amateur) for any bugs they find. Work towards the latest regulatory standards Future proof to upcoming vehicle regulation laws like Transport UNECE WP.29, and ISO/SAE 21434. As connected cars and autonomous vehicles speed towards making our roads safer and giving people a more comfortable driving experience, automotive businesses must ensure they're doing everything they can to protect their products from cyberattacks. A VSOC minimizes the chances of a cybersecurity breach in your plant, on the road and for your customers, so you can focus on building the future of transport.

What to consider before launching a security operations center

  • min read
    • You have some big decisions to make if you're thinking about launching a security operations center (SOC). Some you can easily scope out in advance, but others need further thought. Let me take you through the process and highlight the potential outcomes. How does a security operations center differ from a network operations center? First, you should understand the difference between a SOC and a traditional NOC (network operations center.) NOCs are mostly concerned with keeping the packets flowing through the digital pipes and finding and removing blockages. SOCs extend this basic "plumbing" and ensure that the right packets end up in the right places, and look for inappropriate situations. For example, A NOC would be concerned about abnormal network latency reports, while a SOC might see a rogue endpoint obtain elevated access rights and use lots of network resources that could be causing poor latency. A SOC and a NOC may display a different response to seeing a false positive: Within a NOC, it isn't usually triggered as an issue as its purpose is to send alerts about whether the network is working or not. With a SOC, it could show your infrastructure has been penetrated. Decide whether to build or outsource your SOC The biggest decision in launching a SOC is to decide whether to buy or outsource. Both scenarios have lots of complexities in the decision process and eventual outcome. To build, you can create a physical SOC that sits inside your facilities. For buying, you can use a SOC-as-a-service (SOCaaS) vendor. Sitting in between these two positions is the option to use a managed security solution provider (MSSP). Some MSSPs provide equipment for you to install on-site, others manage everything from their SOC using cloud services. This middle ground could be a good starting place to evaluate your experience before transitioning entirely into a SOCaaS. This can be a good option as you may not understand the entirety of what you have to outsource. Having an MSSP can give you a "SOC-lite" with some managed services and some feedback on security issues without having to completely outsource everything from the start. If you don't yet know the right questions to ask, the MSSP route can give you more context. The origins of SoCaaS vendors Part of the reason for the complex picture: SOCaaS isn't defined consistently from vendor to vendor. It's partly because of the different origins of these vendors: some started as MSSPs, others as specialized managed detection and response vendors, or event or endpoint management providers. Some SOC vendors began life as the services group and subsidiary for a major computing firm or telecoms company selling managed NOCs (e.g HP, IBM and Dell) before moving into the SOC world. In other cases, cybersecurity consultants and solutions providers are developing SOC-like services and frameworks. These origin stories matter because they create an expectation as to the strengths and proprietary technologies that each vendor uses, and also for you to characterize them when you start shopping around. And shop you must – it's a highly fragmented market. Gartner reports that the top MSSPs are IBM, AT&T/AlienVault, Atos, Dell Secureworks and DXC Technology – yet none of them have greater than five percent market share. How to evaluate SOC-aaS vendors The first question you need to define is also the hardest – what are your requirements? From this you can work out your budget and what you will need to purchase first. It's hard, partly because the cloud-based providers always have complex usage-based cost calculations (think pricing an AWS server.) And many of them don't provide any details on their pricing before you engage them for services, or at least sign a non-disclosure agreement. Some of the smaller vendors have fixed monthly fee contracts based on the number of services you consume. When I reviewed a collection of providers, estimates were all over the place, differing by several orders of magnitude. Vendors should be more transparent on costs up front. If you are considering building your own SOC, first compare what the outsourcers will charge, then see if you can make a business case for using that investment to host your SOC in house. Part of the pricing problem: you might not know how many servers or endpoints (or whatever you're protecting) you will initially need with your SOC vendor. You could start small, with a proof-of-concept, and see how the vendor produces reports and interacts with your staff on problems or traffic issues. Planning what services you need Once you get beyond the fee calculation, your next issue is understanding your resources, including the people and tools they need to do their jobs to manage your security and the SOC itself. You might not have the skilled staff to handle incident response, threat hunting and operations management. This might tip the scales towards having a SOCaaS rather than building your own. You'll also want to understand what kind of coverage you'll need. If you operate a global online business, you'll need 24/7 monitoring, and you'll also have to have your staff available at all hours too. You might want a vendor that has multiple physical SOCs on different continents so you can ensure there will be someone somewhere in the world who will be watching your networks from different parts of the world. This multi-zone approach can also expose difficulties that may be faced with latency or accessing your website. Part of your resource evaluation is also in understanding who is staffing the outsourced SOC? What kind of training is required to work there? How many people are on duty on the overnight shifts? Do you have a lead analyst at your provider that you can contact in case of an emergency? Is the vendor's staff managing alerts or are they doing the actual nuts-and-bolts security analysis and providing recommendations on your response and remediation? You'll also want to consider what you're trying to accomplish: Do you want timely breach notifications? Are you deciding to forgo any full-time staff hires or trying to save on new capital equipment? Then comes geography. Where is your equipment, staff, and the actual SOC physically located? If your offices are mainly in a metropolitan area, you may want a SOCaaS vendor who has a secondary office located elsewhere in case of a major disaster (like earthquakes, hurricanes or a tsunami) that could take down your local area's connectivity. Finally, you'll want to define the various component services for your SOC, such as security event management or threat monitoring and detection. Log analysis, vulnerability management and incident response are all necessary and you'll need them eventually, so plan accordingly to be able to scale. Look out for these warning signs It's a good idea to do a proof-of-concept before a full rollout of your SOC. Before you choose your vendor, be alert to these warning signs from a study about improving the effectiveness of SOCs. No similar customers The vendor isn't aligned with your business or doesn't have other customers of similar size, market penetration or type of business. Incompatibility Your legacy event management and service desk systems are compatible with what your SOC vendor provides, and you have to switch to some other system. No visibility You don't have visibility or control over your essential network functions and conditions. Staff frustrations You have high turnover with your security staff and low job satisfaction and high-stress levels. False positives Your SOC is chasing too many false positives and not closing these cases. How to get started With increasing volume and severity of threats on the doorstep of companies of all sizes, now is the time to start planning if your current NOC is going to be enough or if it's time to upgrade to a SOC. According to Artem Karasev from Kaspersky: Good luck with establishing your SOC!

You need a Security Operations Center – and you can afford it

  • min read
    • A Security Operations Center (sometimes called an Information Security Operations Center) is exactly what its name suggests – a team of technical experts in a facility dedicated to the organization's cybersecurity. Its job is to work around the clock to minimize risks, stay up-to-date on threats and risks, and respond to attacks on computers and networks. It's essentially the IT equivalent of a normal security center, the difference being that the team is in front of computers, not CCTV. Threats from cybercriminals are constantly evolving: volumes of data are growing exponentially and legislation is changing fast. As technologies such as 5G and the internet of things (IoT) become mainstream, hackers and other digital criminals have even more options when it comes to gaining access to companies' systems and data. Not only are the risks increasing, but so are the associated financial costs. According to research by Kaspersky, in 2020, the costs of cleaning up after a breach reached an average of $1.09m for enterprise. Why do you need to invest in a SOC? So why do only one-third of businesses have a Security Operations Center? In the past, dedicated SOCs have largely been the preserve of big companies. This was because they were expensive and consumed significant resources and expertise. But it's also because small- and medium-sized businesses have not, traditionally, been as data-intensive as their sprawling multinational counterparts. However, this is changing for a variety of reasons, some positive and some negative. Firstly, even the smallest businesses are now data businesses. They can mine data from customer communications for insights, monitor social media and respond intelligently to use customer data for targeted campaigns. This can mean a lot of data. As business processes move towards total automation, the IT and technology functions in the business have to take on more responsibility for managing these increased risks. Now, more attacks are carried out by highly skilled attackers, so professional security operations teams need to work harder to block them. In tandem with this, cybercriminals, such as the writers of ransomware, no longer just go for the big fish. Rather, they target everyone – the difference between the percentage of small businesses and large businesses attacked is now negligible. Indeed, according to a 2019 cyber-readiness study by the multinational insurers Hiscox, the average cyber-breach costs a small- to medium-sized business $77,000. Although far less than the hit on enterprises, it's a sobering and unexpected cost to foot. It's time to fight back. Or, quite literally, SOC it to them. SOCs are now for all business sizes It's not all bad, though. According to Kaspersky's research, security budgets are growing. What's more, it's now easy and cost-effective to buy in much of the complex tech and expertise from specialists. For small- and medium-sized businesses, this reduces the cost and the headache and answers the "Where do I start?" question. You can set up a SOC without looking at developing costly expertise in-house. There's less hassle and costs are predictable. This removes many of the barriers to an organization launching a SOC. For mid-sized businesses, the boot (or rather the SOC) is now on the other foot. According to Kaspersky's Sergey Soldatov, now is the time to seize the opportunity to establish your SOC: Big businesses are looking to improve their SOCs too In fact, even for large businesses, using a bought-in SOC is becoming increasingly attractive. A recent survey by the SANS Institute, which specializes in IT security, found that specialists working in SOCs had limited satisfaction with their performance but did not have a clear view of how to improve it. This is likely to be because the world of cybersecurity has become so complex that big companies are struggling to keep up with the fast-changing landscape and develop sufficient expertise in-house. Here, the cloud offers an instructive comparison. It has revolutionized the way many companies approach their IT needs. It means that medium-sized businesses can afford the sort of sophisticated solutions that were once only available to multinationals. In fact, many global giants have also discovered that it's more cost-effective and efficient to use outside specialists. We are now seeing something similar with security – increasingly, high-end SOCs are now within everyone's reach, regardless of how big (or small) you are.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries