CISA Red Team Assessment Highlights Critical Detection Gaps Between Two Security Operations Centers
The Cybersecurity and Infrastructure Security Agency released a comparative analysis of red team assessments conducted across two SOCs, revealing that varying log collection ranges and alert tuning lead to significantly different detection outcomes.
The Cybersecurity and Infrastructure Security Agency released an advisory detailing the findings of red team assessments conducted on two separate organizations. Using identical tactics, techniques, and procedures, the assessment highlighted how differences in defensive posture directly impact threat detection. While one security operations center identified the malicious activity quickly, the other failed to detect critical stages of the intrusion, demonstrating the vulnerability of unoptimized monitoring systems.
Primary source
Open CISA Alerts ↗This article summarizes the source. Check the original for full details and conditions.
Comparison
| Aspect | Before / Alternative | After / This |
|---|---|---|
| Log Collection Strategy | Generic, default endpoint and network log collection | Comprehensive, customized coverage of asset-specific events |
| Alert Optimization | Default thresholds leading to alert fatigue or missed events | Tailored correlation rules matching organizational context |
| Attack Phase Detection | Belated detection occurring only after significant post-compromise activity | Early detection during privilege escalation and lateral movement |
| Log Retention and Licensing | Insufficient retention periods preventing thorough post-incident analysis | Optimized log lifecycle management tailored for forensic investigation |
Action Checklist
- Review log collection coverage for critical network and endpoint systems Verify that logs capture early lateral movement and privilege escalation attempts.
- Tune security information and event management alerting thresholds Move away from default rules to reduce alert fatigue and prevent critical events from being overlooked.
- Conduct regular adversary simulation and red team exercises Use these exercises to validate existing detection paths and discover gaps in your visibility.
- Verify log retention policies against incident response requirements Ensure your licensing model allows for sufficient retention duration to perform post-compromise forensics.
