At #15 on our list of “Top 20” SOC Capability Areas is Countermeasure Management. Specifically, a set of capabilities that allow a Security Operations team to identify, validate, evaluate, evolve, and apply a standard set of cyber security countermeasures (both proactive and reactive) to be used uniformly across their entire organization.
Maintaining an evolving knowledgebase of relevant Countermeasures is a core capability for Security Operations teams of even a few Tier 1 Analysts. Historically, such information has been fairly basic, and captured as “standard operating procedures” for fundamental computer restoration after a compromise.
Over the past 10-15 years, the exponential growth in attacks and compromises has led to the creation and standardization of “playbooks” or sets of vetted countermeasures that can be applied in real-time to support incident response (rather than simple, after-the-fact restoration) to recognizable threats. Security Operations teams have adopted sets of more active defensive techniques that range from intentional deception (e.g., honeypots, honeynets, etc.), to dynamic reconfiguration on-the-fly (e.g., terminating processes or connections, editing ACLs, disconnecting systems or services, reconfiguring networks, etc.), to leaving weaponized files for adversaries to exfiltrate (not advised).
Information on these continuously evolving Countermeasures needs to be deliberately managed to properly control their use; including the objectives they are intended to achieve, how and when they should be applied, what the costs or risks may be to apply them, and how effective they are at achieving their objective(s).
Perhaps most importantly, when incidents occur, information about relevant Countermeasures should be immediately and automatically presented to the Tier 1 Analyst. Including giving the Analyst the capability to automatically evaluate the potential business impacts that may result from employing each Countermeasure.
Here, we do not make any assumptions regarding who makes the decision on whether to apply an identified Countermeasure. Only that the Tier 1 Analyst needs an automated capability to build a Decision Space of countermeasure options that can be presented to whomever has the authority to decide under the given circumstances.
NOTE: Automating simple decisions, and implementing a countermeasure or executingresponse actions, is discussed further in the next article on Response Action Management.
However simple or advanced, establishing such a “Playbook” capability to automatically manage the Tier 1 Analyst’s “Decision Space” will significantly improve both the efficiency and effectiveness of your Security Operations.
This article barely scratches the surface of the need for Countermeasure Management capabilities in contemporary Security Operations. But taken together with the other capability areas in this “Top 20” list, we hope to shine a light on the breadth, depth, and complexity of what is involved in building effective Security Operations today.
Contact us if you'd like help identifying and selecting Countermeasure Management capabilities to support your own Security Operations efforts.