We all know socks are comfy. What about the other SOC, the Security Operations Centre? This post is about how to develop one successfully.
Most likely the SOC is in the basement of your company and you have no idea what goes on down there. A Security Operations Centre is a highly organised and well-trained team. Its objective is to preserve and improve the company's security posture by preventing, detecting, analysing and responding to cyber security incidents using technology backed by well-prepared processes. The SOC must have a clearly defined, business-specific strategy with executive support behind it.
Environment matters
The layout of the SOC has to be designed to be comfortable and functional. Lighting and acoustics matter more than you would think. The SOC contains several areas: the operating room, a war room for active incidents, supervisor offices. Comfort, efficiency and control are key.
Technology stack
Several components are needed: firewalls, IPS/IDS, breach detection solutions, SIEM and an orchestration/automation layer to tie everything together. Effective data gathering is fundamental. Data flow, telemetry, packet captures, syslog and events must be collected, correlated and analysed.
People do the work
Machines cannot do it on their own. The three pillars are technology, people and process. The team needs leaders, engineers, analysts and operations professionals. Primary functions: real-time monitoring of events, alerts of security incidents or data breaches, the response to those incidents, triage and damage assessment.
Leadership
Organisational skills are at the front of this. Each member must stick to the plan in place. The SOC manager builds the team, motivates the members, retains people and helps them see business value. The SOC manager and the staff matter as much as the technology, if not more.
In-depth security
LAN segmentation, VPN, endpoint hardening, encryption of data at rest and in motion, well-configured IPS/IDS, firewalls, routers and switches. Nothing is too small to overlook. Collaboration tools have to give members the best user experience.
Running it
When an incident arises, a ticket opens and the case is investigated. Escalation paths leading to a CSIRT can be put in place. With an orchestration product, the team can create playbooks and automate the response, saving the case for future reference.
Originally published 7 April 2017. Migrated to the new IRC site in 2026.