COI Report – Part VII
Page
329 of
425 954. Increased capability for correlation and analysis of data. An ASOC security analyst must have the right tools to identify and analyse an attack. The
ASOC pulls together information
from multiple sources, including endpoints, gateways,
or networked devices, to determine what is important. Without an
ASOC, a security analyst would have to go through the laborious process of checking multiple sources of input. For example, during his investigation into the incidents taking place in January 2018, Benjamin had to
check the antivirus programs, which led him to check PHI s IPS, and finally to look at firewall and proxy logs. He also had to ask the MSS service provider to continue monitoring traffic to the suspicious IP addresses, as the MSS were outsourced to the service provider.
955. Manually checking multiple sources of input is both time-consuming and prone to error. Important sources of input maybe missed. Further, the disorganised nature of information gathering means that larger patterns of suspicious conduct might not be recognised. The better option is for the ASOC to utilise advanced behaviour-based analytics to determine if the pattern of activities across the entire network indicates
a legitimate human user, an innocuous automated processor malicious activity. This shifts the paradigm from log-based, post-incident security to more proactive intelligence-driven security.
956. Full lifecycle management of incidents. The key point is that an ASOC should cover the entire lifecycle of an incident, all the way from initial detection through response and resumption of normal operations. This includes 24 by 7
monitoring, coordination of response teams and processes, and containment and remediation activities, all under one roof to improve response time and reduce confusion.
957. IHiS is currently exploring the option for transitioning the current MSS to an ASOC. The proposal is for the ASOC to have
proactive defence capabilities, including active Threat Hunting. Leong Seng has said that this ASOC will combine people, processes, and technology to better manage IHiS’ overall security defences.
Essentially, a good ASOC would pull together all the strands
