Survey on Operational Security Effectiveness and Maturity

This technical report presents the findings of a survey conducted by SANS Institute regarding the current state of Security Operations Centers (SOCs) and their effectiveness in operational security. The report outlines the necessity of benchmarking and measuring security operations to enhance incident response capabilities. It details the methodologies used to gather data from IT and cybersecurity professionals across various industries and regions. Key objectives of the survey included assessing the frameworks utilized for defining and measuring SOC functions, evaluating the metrics in use, and understanding the maturity of security programs. The findings indicate that a significant portion of organizations employs a hybrid SOC approach, with many utilizing the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) for performance assessment. The report also highlights challenges faced by SOCs, including the recruitment and retention of skilled analysts, and the increasing reliance on managed cybersecurity services. Overall, the report provides valuable insights into the practices and challenges of modern SOCs.