text: As you can read in another blog post from earlier, SOCWISE developed a framework for measuring the maturity of Security Operations activities. We created the questionnaire in RSA Archer GRC tool, then filled it together with several organizations, then evaluated (semi-automatized) them.
  Based on the framework result data, in this post we highlight the area where most interviewed organizations have serious challenges in reaching a good performance. Hereby you can read short suggestions how you can be more effective.
  In the assessment we compare actual performance to functions and capabilities defined in NIST Cyber Security Framework. Then we propose practical development steps and action items based on RSA ASOC characteristics to enable companies to reach better results.
  NIST CSF defines 5 main capabilities in establishing a well performing cybersecurity team. We need certain capabilities to be able to:
  What we experienced after evaluating a series of results, that the Response capability is the CSF domain where most firm shows lack of preparedness.
  Of course, the weaker areas alter by each company, but there are some incompletions which form a revealing pattern. In the followings we enlightened the most common ones.
  We observed that there are many who still not utilize the central SIEM to analyze network packet traffic.
  Although the event data is gathered from various sources, the aggregation and deduplication of collected packets, or more importantly the correlation and further analysis are not performed.
  To monitor network traffic usually logs are collected from different tools (usually IDS, IPS, FW or proxy tools), but we found that collecting from DMZ and server VLANs is rare.