An increasing number of high-profile cyber security incidents, from Sony Pictures to Apple App Store hacking, has encouraged enterprises to invest in and develop their Security Operations Centres (SOCs). It is becoming harder to handle sophisticated security events across complex environments that range from physical IT, to private and public clouds.
Businesses are investing in SOCs to provide a centralised platform for rapid response to cyber breaches. A SOC is an organised, highly skilled team whose mission is to monitor and improve an organisation's cyber security posture, preventing, detecting, analysing and responding to incidents using technology and clear procedures.
What a SOC delivers
To support the business, a SOC must reduce both the time and impact of security-related incidents that exploit, deny, degrade or disrupt operations. Monitoring is the most effective tool to prevent major incidents. A SOC is a machine for incident prevention. It needs a staffing level that matches the size of operations and continuous education so the team stays current.
The SIEM (Security Information and Event Management) is the engine that drives the enterprise security programme. Web proxies, sandboxes, endpoint breach detection and forensic tools all contribute to the SOC ecosystem.
Benefits
- Efficient response time
- Identifying attacks and responding before they cause damage
- Helping recovery in a reasonable time
Functions
- Real-time monitoring and management
- Reporting
- Post-incident analysis
Tasks
The SOC detects attacks from the internet, monitors insider threats, watches compliance and runs incident response. SIEM integrates disparate systems and provides comprehensive threat detection. Logging mechanisms with the ability to track user activity are essential.
The ticketing system helps create, update and resolve reported issues and track progress. More alerts means more work, and more resources to address them. Many alerts can be automated; only complex alerts should reach a cyber security expert.
An incident is a violation or imminent threat of violation of policy or standard security practices: denial of service, unauthorised access, vulnerability exploitation, hacking, data loss. Incidents must be addressed and closed decisively. Impact, severity and timeline of response must be defined for every assigned incident. Unresolved incidents escalate to the next level on a documented procedure.
Originally published 13 March 2017. Migrated to the new IRC site in 2026.