In our last post we covered the benefits, functions and tasks of the Security Operations Centre (SOC). This part continues with the benefits of a well-developed SOC.
The SOC's main job is to find indications that something is wrong in the network and stop it quickly. Efficient, well-streamlined operations are essential. The SOC is usually structured in layers: tier 1 and tier 2 analysts, engineers, management.
The tooling stack
One of the main tools is sensors. They provide logging from firewalls, routers, ACLs, hubs. Collectors gather information from sensors and translate it into a standard format. Custom parsers are usually needed to handle the long tail of log sources.
SIEM solutions have to be tuned to the unique use cases. Use cases must be defined; they are typically the events that need SOC intervention. Examples: finding, containing and removing malware not detected by antivirus, SMTP traffic from an unauthorised host, antivirus failed to clean, repeated attacks from an IP, excessive outbound SMTP, access to a malicious website, exploit traffic from a single IP.
Policies and procedures
Well-described policies and procedures are essential to effective incident response. The SOC needs an internal policy on controls, governance and device configuration. Devices are aligned with policy and the expected job.
Communication is one of the most important parts of a working policy. Make sure information security incidents are promptly reported, events and weaknesses are communicated to the appropriate system administrators, and timely corrective action is taken. A formal information security event reporting procedure underpins effective IR.
In-house SOC versus managed service
A common question is in-house versus outsourced MSSP. Standing up an in-house SOC costs around 750k dollars for tools and infrastructure to start. Headcount of 5 to 9 FTEs, maintenance, depreciation and training adds around 800k a year. An MSSP charges around 500k initial set-up and ongoing yearly subscription. The in-house advantages are a dedicated team, sensitive log data stays in-house, known environment, easier customisation. The disadvantage is the up-front cost. The MSSP advantages are fewer capital expenses, access to security expertise, scalability, and the MSSP's wider threat intelligence.
Service management
The SOC should be process-driven, with functions documented as part of a runbook. ITIL is one useful baseline for service strategy, design, KPIs, SLAs, transitions, change management, operations and continual improvement. With well-managed operations and team, an enterprise can ensure service quality and feel confident in its response to security events.
Originally published 15 March 2017. Migrated to the new IRC site in 2026.