5.5Protected data, intrusion models, and SOC metrics

Even in the same breach, whether what was stolen is a published catalog or a patient's medical record changes both the severity and the legal obligation entirely. That is why a SOC must be able to identify what is protected data. Furthermore, fitting fragmentary alerts into an intrusion model (Cyber Kill Chain, Diamond Model) reveals the whole picture of the attack and "what comes next." And a team's strength is measured and improved with SOC metrics (time to detect, contain, respond, control). This section ties these together as "the judgment of classifying events and improving."

5.5.1Protected data in a network

• PII (personally identifiable information)—information that can identify an individual, such as name, address, date of birth, and national ID. PHI (protected health information)—healthcare-related personal information such as medical records, history, and insurance, subject to especially strict regulation (e.g., U.S. HIPAA). Given the impact and legal weight of a leak, both are top-priority protection targets.
• PSI (sensitive personal information / payment-related information)—payment card numbers and especially sensitive personal data whose leak is highly damaging (including regulated data such as PCI DSS). Intellectual property (IP)—designs, source code, trade secrets, the source of an organization's competitiveness; even with lighter regulatory duties, leakage directly damages the business. Which data type it is changes how to protect it, notification duties, and priority.

5.5.2Intrusion models

• The Cyber Kill Chain—a seven-stage attack model from Lockheed Martin: reconnaissance -> weaponization -> delivery -> exploitation -> installation -> command and control (C2) -> actions on objectives. It views an attack in stages, holding that the earlier you break the chain, the smaller the damage. Discerning which stage an event is in lets you anticipate the next move.
• The Diamond Model—an analysis model that views a single intrusion event through the relationships among four vertices: adversary, capability, infrastructure, and victim. Knowing one vertex helps infer the others (e.g., from the malware used = capability, trace to the C2 server = infrastructure or the adversary). The stage-based Kill Chain and the relationship-based Diamond Model are used complementarily.

5.5.3SOC metrics and scope analysis

• SOC metrics measure operational capability by the time each response phase takes: time to detect (from compromise to noticing), time to contain (until the spread is stopped), time to respond (until response begins), and time to control (until the threat is brought under control). The shorter these are, the more damage is limited.
• These metrics tie to scope analysis (how far the damage reached). When detection lags, the attacker's dwell time lengthens and the breach spreads. Measuring the metrics continuously reveals which phase is the weak point (e.g., detection is fast but containment is slow), justifying priorities for investment and automation. Metrics are not only for evaluation but a compass for improvement.

In a manufacturer's SOC, executives ask, "What kind of attack was last month's incident in the end, and where was our defense weak?" You re-order the fragmentary logs along the Cyber Kill Chain: a crafted phishing email to an executive (delivery), exploitation via the opened attachment, installation on the endpoint, then C2 traffic to the outside, and finally exfiltration of design documents (intellectual property, IP) as actions on objectives. Laid out by stage, you can articulate which stage's defense failed: "the mail filter should have stopped delivery," "EDR could have broken the chain at installation or C2." Next, with the Diamond Model, you assess the likelihood of similar attacks by the same adversary from the malware used (capability) and the C2 destination (infrastructure). And the "weakness in defense" the executives really want is quantified with SOC metrics. This time, time to detect was long—weeks—during which the attacker dwelled and even exfiltrated IP, whereas once detected, time to contain was short—so the weak point is not "response speed" but "slowness in noticing." Crucially, because the stolen data was intellectual property rather than a public catalog, the damage was severe, and this kind of attack differs in regulatory-notification handling from PII or PHI—this identification of protected data set the response priority. Only by combining the three—classifying the event with an intrusion model, quantifying the weakness with SOC metrics, and judging severity and obligation by the protected-data type—do you reach a conclusion you can give the executives about "where to invest next" (here, speeding up detection).

5.5.4Section summary

• Identify protected data as PII (identity)/PHI (health)/PSI (sensitive/payment)/IP (intellectual property); the type changes severity, notification duty, and priority
• The Cyber Kill Chain is seven attack stages; the Diamond Model is four vertices (adversary, capability, infrastructure, victim); classify events complementarily by stage and relationship
• SOC metrics (time to detect/contain/respond/control) are better when shorter and serve as a compass to identify the weak phase and justify improvement investment