Maximus Logo
Country
United States Canada India Saudi Arabia United Arab Emirates United Kingdom
  • Careers
  • Employees
  • Investor Relations
  • News and Events
  • Who We Serve
    Federal Government State and Local Government Specialized Markets

    As trusted partners, we elevate public service by empowering government agencies with advanced technology, infrastructure, and human-centric operational support.

  • What We Do
    Customer Experience
    • Contact center solutions and services
    • Digital Government
    • Maximus Innovation Center
    Technology Services
    • AI and Analytics Services
    • Cybersecurity
    • Cloud
    • Digital Modernization
    • Data Management
    Health Services
    • Clinical Services
    • Eligibility and Enrollment
    • Health IT Modernization
    Program Services
    • Case Management
    • Consulting and Advisory Services
    • Eligibility and Enrollment
  • Case Studies
  • Insights
  • About
    Our Approach
    Life at Maximus
    Leadership
    Locations
    Maximus Foundation
    Corporate Responsibility
    Contract Vehicles
    Awards and Recognition
    Alliance Partnerships
    Certifications
    Maximus Ventures
  1. Maximus
  2. Insights
  3. Preparing your SOC for the future

Preparing your SOC for the future

August 26, 2024

Share:

X LinkedIn Email

Enable Cookies to view videos on site.

View on YouTube

As technology rapidly evolves, so do the methods used by malicious hackers. The introduction of artificial intelligence (AI) into the cybersecurity landscape has created a new battleground, where threat actors leverage AI to become more sophisticated and harder to detect. Cybersecurity professionals and their Security Operations Centers (SOCs) must adapt quickly to stay ahead of these emerging threats.

The Rise of AI in Cyberattacks

Dean Irwin, Senior Director of Cybersecurity at Maximus, highlights a growing concern: AI is being used more offensively than defensively in the realm of cybersecurity. "Cybersecurity is rapidly changing, and a big introduction is what’s happening in AI," Irwin notes. "It’s making threat actors able to be very sophisticated." This sophistication allows hackers to enhance their capabilities in several areas, most notably in identity theft and spear phishing attacks.

With the increased use of cloud services, the traditional model of network perimeter defenses is becoming obsolete. In a cloud environment, "it’s all about identity," Irwin explains. AI-driven deep fakes can impersonate employees or even government officials, making it crucial for SOCs to focus on identity protection. Furthermore, AI empowers attackers to craft highly personalized spear phishing and whaling emails, targeting top executives in an organization with low-volume, high-impact attacks that are challenging for traditional detection tools to identify.

Adapting SOC Strategies to AI-Driven Threats

To counter these evolving threats, Irwin emphasizes the importance of continuous training for SOC staff. "We are constantly training and certifying in specific technologies," he says, underscoring the need for cybersecurity teams to stay current with the latest tools and techniques. At one of Maximus's SOCs, each employee holds three certifications, a testament to their commitment to maintaining a high level of expertise.

One key strategy for SOCs to stay ahead is leveraging Cyber Threat Intelligence (CTI). This approach involves understanding the methods used by hackers, including their activities on the dark web, where they discuss plans and share tools. CTI allows SOCs to anticipate and prepare for potential attacks by gathering intelligence on emerging threats and understanding the tactics, techniques, and procedures (TTPs) of threat actors.

Another critical component is monitoring for "beaconing" signals from executables that may have infiltrated the network undetected. This proactive stance ensures that SOCs are not only focused on inbound threats but also on identifying malicious activities that might have already penetrated their defenses.

Collaboration and Communication: The Human Element in SOCs

While advanced tools and AI-driven analytics are essential, the human element remains a cornerstone of effective cybersecurity operations. Irwin stresses the importance of open communication between SOC staff, application owners, and IT operations teams. "We have to prove to the system owner that this is actually a compromise and not normal traffic," he explains, highlighting the need for SOCs to build trust and educate their stakeholders about cybersecurity threats.

In large environments, such as a system encompassing 60,000 endpoints and 5,000 servers, SOCs must be prepared to act swiftly upon detecting anomalies. This often requires coordination across multiple teams and a clear understanding of each unit’s role in responding to potential incidents.

Implementing Best Practices in Security Operations Centers

To effectively counter AI-driven cyber threats, Irwin outlines three essential components of a robust SOC:

  1. Security Event Information Management (SEIM) Systems: These systems continuously monitor for intrusions and attempted breaches, providing a first line of defense against malicious activities.
  2. Endpoint Monitoring: Given the diversity of endpoints—from smartphones and PCs to IoT devices—this component requires a variety of tools to manage and secure different types of devices effectively.
  3. Data Sandboxing: This environment allows cybersecurity professionals to analyze log data and malware safely, utilizing both commercial and custom-built tools to detect and mitigate threats.

Preparing for the Future of Cybersecurity

As cybersecurity threats continue to evolve, driven by the capabilities of AI, organizations must adapt their strategies to ensure robust defenses. This includes not only investing in advanced technology and tools but also fostering a culture of continuous learning and collaboration within SOC teams.

Organizations should also focus on modernizing their systems, moving beyond simple shifts to the cloud and considering secure software design principles, such as using memory-safe languages. Understanding the provenance of software and the specific technologies in use is also crucial for maintaining a strong security posture.

Finally, SOC staff should be rewarded for achieving new certifications and skills, reinforcing the importance of staying ahead in a constantly changing field. By combining the right mix of technology, human intelligence, and proactive strategies, cybersecurity practitioners can better prepare their SOCs to face the challenges posed by AI-enhanced cyber threats.

Access the ebook - Securing the Nation: Deep dive into federal SOCs

Related Topics

Cybersecurity Federal Government Defense

Read more

Video

DHA modernizes for better service

Article

The role of agentic AI systems in driving next-gen CX

Video

How emerging tech drives customer experience improvements in government

Partnering with Maximus can help you stay one step ahead

Let us help you get there

Get started
Maximus Logo
  • Contact Us
  • Careers
  • Contract Vehicles

Copyright © 2025 Maximus. All rights reserved.

Privacy Statement Privacy Statement California Residents Terms of use