Bleed rule--remove from file Bleed rule--remove from file MITRE’s accumulated Ten Strategies of a World-Class Cybersecurity Operations Center conveys MITRE’s expertise on accumulated expertise on enterprise-grade computer network defense. It covers ten key qualities enterprise- grade of leading Cybersecurity Operations Centers (CSOCs), ranging from their structure and organization, computer MITRE network to processes that best enable effective and efficient operations, to approaches that extract maximum defense Ten Strategies of a World-Class value from CSOC technology investments. This book offers perspective and context for key decision Cybersecurity Operations Center points in structuring a CSOC and shows how to: • Find the right size and structure for the CSOC team Cybersecurity Operations Center a World-Class of Strategies Ten The MITRE Corporation is • Achieve effective placement within a larger organization that a not-for-profit organization enables CSOC operations that operates federally funded • Attract, retain, and grow the right staff and skills research and development • Prepare the CSOC team, technologies, and processes for agile, centers (FFRDCs). FFRDCs threat-based response are unique organizations that • Architect for large-scale data collection and analysis with a assist the U.S. government with limited budget scientific research and analysis, • Prioritize sensor placement and data feed choices across development and acquisition, enteprise systems, enclaves, networks, and perimeters and systems engineering and integration. We’re proud to have If you manage, work in, or are standing up a CSOC, this book is for you. served the public interest for It is also available on MITRE’s website, www.mitre.org. more than 50 years. Carson Zimmerman is a Lead Cybesecurity Engineer with The MITRE Corporation. He has ten years of experience working with various CSOCs to better defend against the The MITRE Corporation adversary. He has held roles in the CSOC ranging from 202 Burlington Road tier 1 analyst to architect. Bedford, MA 01730-1420 (781) 271-2000 7515 Colshire Drive McLean, VA 22102-7539 (703) 983-6000 www.mitre.org Carson Zimmerman © 2014 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution unlimited. MITRE Case number 13-1028. MITRE Bleed rule--remove from file Bleed rule--remove from file MITRE Ten Strategies of a World-Class Cybersecurity Operations Center Carson Zimmerman © 2014 by The MITRE Corporation. All rights reserved. Produced by MITRE Corporate Communications and Public Affairs International Standard Book Number: 978-0-692-24310-7 Printed in the United States of America on acid-free paper The views, opinions, and/or findings contained in this book are those of The MITRE Corporation and should not be construed as an official government position, policy, or decision, unless designated by other documentation. This book discusses observations and ideas, and The MITRE Corporation expressly disclaims any warranty of any kind. Although products are discussed in this book, nothing in this book should be construed as an endorsement of any kind. The trademarks used herein belong to their respective holders. Approved for public release; distribution unlimited. Case Number 13-1028. The MITRE Corporation 202 Burlington Road • Bedford, MA 01730-1420 • (781) 271-2000 7515 Colshire Drive • McLean, VA 22102-7539 • (703) 983-6000 www.mitre.org [email protected] Send feedback or questions on this book to [email protected]. Acknowledgments There are many individuals whose hard work has contributed to the creation of this book. First of all, I would like to recognize Eric Lippart, whose many years of work in computer network defense (CND) contributed to every aspect of this book. The ten strategies outlined in the book emerged from the years we worked together to share best practices and solutions for CND across the U.S. federal government. Some sections of this book are based, in part, on material from other MITRE work. The following sections incorporate ideas and expertise from other MITRE staff members: Scott Foote, Chuck Boeckman, and Rosalie McQuaid: Cyber situ- ational awareness, Section 2.5 Julie Connolly, Mark Davidson, Matt Richard, and Clem Skorupka: Cyber attack life cycle, Section 2.6 Susan May: CSOC staffing, S e c t ion 7. 2 Mike Cojocea: Security information and event management (SIEM) and log management (LM) best practices, Section 8.3 Joe Judge and Eugene Aronne: Original work on intrusion detection systems (IDS) and SIEM, Section 8.2 and Section 8.3 Frank Posluszny: Initial concept and development of material on Cyber Threat Analysis Cells, Sections 11.1–11.6 Kathryn Knerler: CND resources and websites, Section 11.7 iii Acknowledgements Therese Metcalf: Material on various government CSOCs, which was used throughout this book Bob Martin: Technical editing and glossary Robin Cormier: Public release and project management Robert Pappalardo and John Ursino: Cover design Susan Robertson: Book layout and diagrams The following individuals are recognized as peer reviewers for this book: Chuck Boeckman, Mike Cojocea, Dale Johnson, Kathryn Knerler, Eric Lippart, Rick Murad, Todd O’Boyle, Lora Randolph, Marnie Salisbury, Ben Schmoker, Wes Shields, and Dave Wilburn. This book would not have been possible without the funding and mentorship provided by MITRE’s cybersecurity leadership: Gary Gagnon, Marnie Salisbury, Marion Michaud, Bill Neugent, Mindy Rudell, and Deb Bodeau. In addition, Lora Randolph’s and Marnie Salisbury’s advice and support were instrumental in making this book possible. This book was also inspired by the excellent work done by the Carnegie Mellon University (CMU) Software Engineering Institute (SEI) Computer Emergency Response Team (CERT®), whose materials are referenced herein. Their copyrighted material has been used with permission. The following acknowledgement is included per CMU SEI: This publication incorporates portions of the “Handbook for Computer Security Incident Response Teams, 2nd Ed.,” CMU/SEI-2003-HB-002, Copyright 2003 Carnegie Mellon University and “Organizational Models for Computer Security Incident Response Teams,” CMU/SEI-2003-HB-001, Copyright 2003 Carnegie Mellon University with special permission from its Software Engineering Institute. Any material of Carnegie Mellon University and/or its Software Engineering Institute contained herein is furnished on an “as-is” basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied, as to any matter including, but not limited to, warranty of fitness for purpose or mer- chantability, exclusivity, or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to free- dom from patent, trademark, or copyright infringement. This publication has not been reviewed nor is it endorsed by Carnegie Mellon University or its Software Engineering Institute. CERT is a registered trademark of Carnegie Mellon University. I would like to recognize the tireless efforts of the many operators, analysts, engineers, managers, and executives whose contributions to cyber defense have helped shape this book. iv Ten Strategies of a World-Class Cybersecurity Operations Center This book is dedicated to Kristin and Edward. About the Cover “Now, here, you see, it takes all the running you can do, to keep in the same place. If you want to get somewhere else, you must run at least twice as fast as that!” — The Red Queen, to Alice, in Lewis Carroll’s Through the Looking Glass The adversary is constantly advancing its capabilities. Enterprise networks are always adapting to accommodate new technologies and changing business practices. The defender must expend all the effort it can just to stay in the same relative place, relative to what it must protect and defend against. Actually advancing its capabilities—matching or getting ahead of the adversary—takes that much more effort. Stealing a concept from evolutionary biology, we draw a parallel others in cybersecu- rity have to the Red Queen Hypothesis. The Cybersecurity Operations Center must con- stantly evolve its tactics, techniques, procedures, and technologies to keep pace. This is a frequent refrain throughout the book. v vi Contents Acknowledgments iii Executive Summary 1 Introduction 3 Fundamentals 8 Strategy 1: Consolidate CND Under One Organization 44 Strategy 2: Achieve Balance Between Size and Agility 49 Strategy 3: Give the SOC the Authority to Do Its Job 71 Strategy 4: Do a Few Things Well 80 Strategy 5: Favor Staff Quality over Quantity 87 Strategy 6: Maximize the Value of Technology Purchases 108 Strategy 7: Exercise Discrimination in the Data You Gather 175 Strategy 8: Protect the SOC Mission 206 Strategy 9: Be a Sophisticated Consumer and Producer of Cyber Threat Intelligence 221 Strategy 10: Stop Think Respond Calmly 250 References 258 Appendix A: External Interfaces 278 Appendix B: Do We Need Our Own SOC? 282 Appendix C: How Do We Get Started? 286 Appendix D: Should the SOC Go 24x7? 291 Appendix E: What Documents Should the SOC Maintain? 295 Appendix F: What Should an Analyst Have Within Reach? 301 Appendix G: Characteristics of a World-Class SOC 307 Appendix H: Glossary 319 Appendix I: List of Abbreviations 326 Index 332 vii Figures Figure 1 SOC Roles and Incident Escalation 14 Figure 2 OODA Loop 26 Figure 3 Cyber Attack Life Cycle 30 Figure 4 Typical SOC Tool Architecture 33 Figure 5 Context to Tip-offs: Full-Spectrum CND Data 34 Figure 6 CND