Understand current SOC capabilities and resources

To determine where you are going, you must understand where you are. Examine your environment to better understand your current technology stack. How many resources do you have within your SOC? Do any have experience with monitoring OT environments? Most organizations have minimal capacity to monitor the additional OT data sources and limited understanding of the OT environments. Without strong knowledge of your current capabilities, it can easily become too ambitious to consider future-state possibilities.

Define OT SOC vision and objectives

Without clear objectives, most initiatives never actually get off the ground. Objectives can define desired coverage, functions provided, reporting requirements and more. These are essential to keeping your organization focused on what matters the most to your company, while also facilitating an effective balance of cost and risk mitigation. The NISTIR 8428 “Digital Forensics and Incident Response Framework for OT” publication provides a great framework to understand the basic phases of OT monitoring and may help you define the vision of your OT SOC. Clearly defined objectives will allow you to decipher whether an integrated IT/OT SOC, a standalone OT SOC or a managed security services provider (MSSP) for OT SOC is the best decision for your organization.

Strategize IT/OT plans for detection and response for critical OT use cases

Focus is important to efficiently achieve any goal. The same is true for your OT SOC. OT monitoring technologies can provide so much information that might be hard to digest in an organization. Defining critical use cases, such as rogue devices on a network or malware on the OT network, is key. Plus, it is important to develop workflows of how to respond to these cases with sites that help filter through the noise and increase the value of your investments. Ensure that operational technology resources are included in your strategy as one of the keys of IT/OT convergence is an IT/OT partnership.

Common challenges that organizations encounter when developing these workflows involve insufficient security analyst knowledge to properly respond to alerts in OT, friction or a lack of communication between IT and OT resources and a lack of sufficient planning/testing response plans. For example, most organizations do not have clear plans in place on how to manage response for their OT environments if the IT environments become compromised. These challenges can be overcome by workshopping these plans and playbooks with resources across different domains of IT and OT.

Develop technology and resourcing plan to incorporate OT

With the process defined, defining the requirements for resourcing and technology is the next important step. For resourcing, many organizations either develop strategies to upskill their security analysts, hire or shift OT personnel to be SOC analysts or outsource that skillset for IR purposes. For the average organization, a successful resource model involves providing basic awareness and training to all SOC analysts, as well as having a dedicated resource that understands deeper details around OT assets. The goal with resourcing is to have a sufficient model to be able to minimize false positives. Therefore, the escalations that are brought to the site have a higher fidelity of threat to the OT environment. For additional information about the competencies needed in various OT roles, CSA Singapore has built a helpful competency framework. Core technology that supports OT monitoring includes cyber-physical protection platforms, endpoint solutions and firewalls. These can be augmented by other OT security technologies and OT logging. Technology can drive resourcing requirements, or technology requirements may be driven from resourcing.

Common challenges from a technology standpoint include insufficient alert tuning, which creates alert fatigue, and insufficient budget to effectively monitor all sites with the same rigor. When developing your requirements, keep in mind that if you can factor facility criticality within your decision-making process, you can develop different requirements per site type. From a resourcing standpoint, security analysts often do not feel comfortable with OT telemetry data. Often, companies either create a training plan for a SOC analyst to become an OT expert for the SOC, or they actually onboard a resource from the facilities to become a SOC analyst.

Test your plan with one site, tune your strategy and develop a methodology for scaling

Perfection is the enemy of progress. As your OT SOC people, process and technology plans become more mature, there is an urge to perfect the strategy before rolling it out. But for most initiatives, it is better to have more of an iterative approach. This is because you will be constantly learning as you work with different sites. In most OT companies, no two sites are completely the same, and it is best to learn and adapt. As companies begin to onboard their OT environments, it is best to identify a partner with which you can effectively roll out a monitoring design. Rolling out the strategy at one facility will allow you to correct errors before you scale and build out a framework to roll out to other sites or business units.

Onboard and initiate SOC services to your fleet of sites

Embedding stronger OT security best practices through a fleet of sites truly makes OT a journey. The journey will encompass effectively budgeting capital, internal/external resources and other organizational priorities. It will also require buy-in, not just from the IT/security teams, but also from the operational teams across your sites. The best way to accomplish this is by effectively creating a rollout plan. Being able to communicate the what, when and why of this journey to various stakeholders is critical to success.