HPE SIOC Assessment Tool

SIOC Capabilities tool

Intro
People
Process
Technology
Services
Results

Step 1

Business size

Select the size of your business. This will be your budget for the rest of the experience.

Available
Funds:

YOU ARE OVER BUDGET

Small

Medium

Large

Enterprise

Step 2

Budget allocation

How would you like to allocate your budget? Total should equal 100%.

Available
Funds:

YOU ARE OVER BUDGET

People

Process

Technology

Services

Step 3

Business requirements

Which of these business requirements apply to you? Select all that apply.

Available
Funds:

YOU ARE OVER BUDGET

Retain logs for 1 or more years

Undergo 3rd party audits, per regulation

Detect breaches on critical systems

Respond to breaches within an SLA

Disclose breach details, per regulation

Monitor for security conditions, 24x7

Now that you've completed the Intro section, click on the People tab to answer questions for that section.

Previous Next

Step 1

Staff selection

What staff will be included in your SOC team? Select all that apply.

Available
Funds:

YOU ARE OVER BUDGET

SIEM Engineer

8x5 Level 1 Analysts

24x7 Level 1 Analysts

8x5 Level 2 Analysts

24x7 Level 2 Analysts

Hunt Team

Dedicated CERT Team

Digital Investigations Team

Security Device Engineers

Security Generalist

Step 2

Training and Certification

What % of staff will receive external training annually?

Available
Funds:

YOU ARE OVER BUDGET

Step 3

Staff experience

What is the experience level of your staff?

Available
Funds:

YOU ARE OVER BUDGET

Average experience

Average 1 year experience

Average 2 years experience

Average 3 years experience

Average 4 years experience

Average 5 year experience

Average 6 years experience

Average 7 years experience

Average 8 years experience

Average 9 years experience

Average 10 years experience

Average 10+ years experience

Step 4

Leadership

How strong is your SOC leadership?

Available
Funds:

YOU ARE OVER BUDGET

Weak Leadership

Average Leadership

Good Leadership

Great Leadership

Now that you've completed the People section, click on the Process tab to answer questions for that section.

Previous Next

Step 1

Knowledge Management System

What sort of knowledge management system will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

HomeGrown

Industry standard

Portable and collaborative system hosted within infrastructure or cloud that allows for simplified publishing, revision control, search, categorization, indexing, expanded storage, and document aging

Step 2

Operational Processes

What level of operational processes will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Low

Medium

High

Measurable execution of roles and responsibilities that demonstrates staffing of key functions, situational awareness of current execution, and ability to adapt and respond as operational needs increase

Step 3

Business Processes

What level of business processes will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Low

Medium

High

Fully funded based on measurable tracking of KPIs that demonstrate business, IT, and security value

Step 4

Technology Processes

What level of technology processes will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Low

Medium

High

Ongoing architectural reviews, metrics on IT situational awareness coverage, recurring content development for emerging risks and threats, and active system management beyond vendor defaults

Step 5

Analytical Processes

What level of analytical processes will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Low

Medium

High

Cataloguing internally and externally generated threat intelligence, actors, and other attribution factors; metrics on detection and response automation from analytical outputs

Step 6

Process Automation / Orchestration

What level of process automation and orchestration will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Low

Medium

High

Repeatable tasks automated based on severity and escalation paths

Step 7

Process Management

What level of process management will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Low

Medium

High

Regularly updated audited processes with quarterly walk-through drills

Now that you've completed the Process section, click on the Technology tab to answer questions for that section.

Previous Next

Step 1

Security Architecture

What security architecture will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

Ad hoc

Whiteboards and cocktail napkins

Minimal

High-level network design documents exist

Moderate

Standards for system configuration, network diagrams

Comprehensive

Standards for system configuration, data classification, data collection, and detailed network diagrams

Step 2

Identity and Access Management

What identity and access management solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Distributed by system and application

Minimal

Basic centralized OS directory services

Moderate

Infrastructure authentication, authorization, accounting (AAA) solutions

Comprehensive

Multifactor authentication, authorization, accounting (AAA) systems

Step 3

Configuration Management

What configuration management solutions will you deplpoy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Manually maintained spreadsheet

Moderate

Centralized poll and gather system

Comprehensive

Agents deployed on systems that catalog apps, processes, and critical configuration files

Step 4

Threat & Vulnerability Management

What threat and vulnerability management solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Vulnerability scans performed

Moderate

Vulnerability scans performed with automated reporting and manual remediation enforcement

Comprehensive

Vulnerability scans performed with a centralized risk register and automated remediation enforcement

Step 5

Perimeter Protection

What threat and vulnerability management solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Basic router ACL or ISP supplied security, perimeter firewall

Minimal

IDS/IPS deployment and monitoring

Moderate

Perimeter next-generation firewall or UTM for upper protocol inspection

Comprehensive

Comprehensive multizone, tiered, boundary solutions including next-generation firewalls, intrusion prevention proxy, URL and email filtering, VLANs, secure protocol reference architectures, etc.

Step 6

Data Protection

What data protection solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Data classification and use of next-generation firewall, intrusion prevention, UTM capability

Moderate

Implementation of dedicated data loss prevention and encryption

Comprehensive

Internal and external scraping, behavior analysis, machine learning

Step 7

Log Management

Which log management solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Base system and application logging

Minimal

Consolidated syslog for critical infrastructure and compliance devices

Moderate

Centralized, retention span identified, classification understood

Comprehensive

Centralized, searchable, archived, restorable, analyzed

Step 8

SIEM

What SIEM solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Home-grown solution

Moderate

Single-pane-of-glass technology

Comprehensive

Correlation capabilities utilized

Step 9

Analytics / Security Intelligence

Which analytics / security intelligence solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Home-grown data lake developed

Moderate

Some analytics technologies with non-integrated threat intelligence feeds

Comprehensive

Analytics technologies deployed with threat intelligence feeds

Step 10

APT

Which APT detection solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Limited ability to understand the scope of the APT environment

Moderate

Somewhat repeatable ability to collect indicators of compromise (IOC) and detect APT in your environment

Comprehensive

Understanding of APT environment and ability to remove threat actor

Step 11

Malware

Which malware detection and remediation solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Ability to perform malware analysis in-house or via third party

Moderate

Ability to detect zero-day malware

Comprehensive

Ability to differentiate commodity malware from APT

Step 12

Forensics

Which forensics solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Forensic certified/skilled staff

Moderate

Ability to perform local and remote forensics

Comprehensive

Ability to maintain chain of custody during investigations to support legal admissibility requirements

Step 13

Automation / Orchestration

Which automation / orchestration solutions will you deploy? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Minimal

Scripts created to automate some tasks, opportunistically developed

Moderate

Operations/incident orchestration products deployed

Comprehensive

Staff dedicated to develop and maintain custom orchestration solutions

Now that you've completed the Technology section, click on the Services tab to answer questions for that section.

Previous Next

Step 1

Professional Services

Which professional services will you employ? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Low

On retainer

Medium

Performing tactical projects and offloading internal workload

High

On staff or performing recurring, strategic reviews

Step 2

Staff Augmentation

Which staff augmentation services will you employ? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

100% employee staff

Low

Some leveraged consultants

Medium

Ample leveraged consultants

High

100% consulting staff

Step 3

Augmented Device Management

Which augmented device management services will you employ? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

No device management outsourced

Low

Some device maintenance and updates outsourced

Medium

Hybrid model: first line outsourced, second line in-house

High

Fully outsourced monitoring capabilities

Step 4

Augmented Security Monitoring

Which augmented security monitoring services will you employ? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

No monitoring functionality outsourced

Low

Hybrid model: after hours outsourced

Medium

Hybrid model: first line outsourced, second line in-house

High

Fully outsourced monitoring capabilities

Step 5

Augmented Incident Response

Which augmented incident response services will you employ? Pick one.

Available
Funds:

YOU ARE OVER BUDGET

None

Fully insourced incident response

Low

Mostly handled in-house, occasionally leverage vendor

Medium

Outsource large breaches, handle the rest internally

High

Fully outsourced to an incident response focused vendor

Now that you've completed the Services section, click on the Results tab.

Previous Next

Results:

Remaining
funds:

YOU ARE OVER BUDGET

Thank you for completing the SIOC experience. Allocating security resources effectively is a recurring exercise for executives given the dynamic nature of users, applications, and data within an evolving threat landscape. The simulation results provide general guidance about the benefits of allocating budget across four distinct areas and the risks associated with underfunding components of your cyber security program. Here is your cyber security model given the data provided.

You selected the following parameters for your cyber security detection and response program:

Given this business environment and selections for your SOC capabilities, here is how you rated:

To learn more about what the best SOCs in the world are doing, read the "State of Security Operations 2016 report of capabilities and maturity of cyber defense organizations."

Build your SOC

This simulation lets you go on a virtual shopping spree to invest in your SOC. We'll ask you 32 easy-to-answer questions related to your people, processes, technologies, and services. It's not timed, and you can skip around and come back to a question at your leisure.

You'll choose your organization size, allocate your budget, and select business requirements.^[1] Based on how you allocate your budget across four areas—people, processes, technologies, and services—we'll share guidance about your capabilities and suggestions for improvement. You'll learn about the benefits associated with your investment distribution as well as the risks of underfunding certain areas of the SOC.

The result? A cyber security model of your SOC that helps you better understand how to:

Find the bad guys on a budget
Protect your users, applications, and data
Run your security operations efficiently and effectively
Allow your business to Innovate fearlessly

^[1] Please note that $1 in this simulation does not represent $1 in the real world.

Not sure where to start?
Read Building a successful SOC

The questions in this section address how you'll spend your budget on people—including resources, staffing, training and certifications, and leadership.

Did you know?

The number-one concern of cyber defense organizations is access to skilled resources. ²

² "State of Security Operations 2016 report of capabilities and maturity of cyber defense organizations," Hewlett Packard Enterprise, January 2016.

Not sure where to start?
Read Building a successful SOC

In this section, we'll explore the different levels of processes and orchestration and how they can help you become more efficient and effective.

Did you know?

Twenty-four percent of cyber defense organizations are not providing minimum security monitoring capabilities. ³

³ ibid.

Not sure where to start?
Read Building a successful SOC

The questions here ask you about various technologies and will make sure that you're investing in the most appropriate and cost-effective tools for your organization.

Did you know?

Most organizations focus heavily on technology solutions and tools without matching that effort with the people and process aspects of a cyber defense program. ⁴

⁴ ibid.

Not sure where to start?
Read Building a successful SOC

For this section, our questions focus on what services you'll employ and how they'll be employed (fully in-house or outsourced, or a hybrid of both).

Did you know?

HPE ESP Global Services take a holistic approach to building and operating cyber security and response solutions and capabilities that support the cyber threat management and regulatory compliance needs of the world's largest enterprises. ⁵

⁵ "5G/SOC: SOC Generations," HPE ESP Security Intelligence and Operations Consulting Services business white paper, November 2015.

Not sure where to start?
Read Building a successful SOC