Functional model of SOC maturity assessment based on a maturity model

Abstract

Leading modern organizations that use advanced technologies in their business processes require a high-level approach to managing the cybedefence process, regardless of the appointment of technical means usage - introspection technology (IT), industrial control systems (ICS), cyberphysical systems (CPS), or IoT devices. Therefore, the main task of IS specialists lies in the choice of standards and frameworks in the field of information technology, which contain requirements, guidelines and recommendations for the organization of up-to-date processes of cyberdefense and information security management. Security Operations Centers (SOCs), which functionate under the guidance of organizations, operate on the basis of admitted and documented usage of standards and recommendations. As for today, the problematic issue lies either in documenting instructions for the implementation of their own SOCs as they differ in functionality depending on goals and scale of implementation, available financial resources or models for assessing the maturity and capabilities of SOCs, most of which are poorly described and suggested with IT industry leaders as a commercial service. The purpose of this work is to analyze the functioning of maturity and capability assessment models in the management strategy of organization`s information security sphere and to create the functional model of assessing the level of SOC maturity, which is based on the chosen maturity model. The results of a such model`s implementation allow us to use a single approach in the process of assessing the maturity level of both individual domains and SOC in general, regardless of the choice of a maturity model with analyzing the calculations from simple metrics of achieving goals (Key Result Indicators, KRI) to business-oriented metrics. The subsequent model decomposition enables to formulate specific requirements for simple metrics on which the calculation of complex metrics is based, as well as more precisely determine the methods of analysis of the performed calculations.