security operations center

Page 5 of 4

Establishing IT Infrastructure Through Security Operations Centers

Small companies face a harsh reality: As much as 60 percent of small and medium-sized businesses that are hacked fail within six months of the cyber attack. Organizations need to have a cybersecurity strategy in place to identify and mitigate any potential threats. While there are many strategies to secure your business, a Security Operations Centers (SOC) can truly expand your vulnerability detection capabilities. This article reviews the benefits and challenges of a modern SOC and the differences between a SOC and a Computer Security Incident Response Team (CSIRT) team.

What Is a SOC?

A security operations center is a team of people who are responsible for identifying security issues and incidents, monitoring systems and responding to events. SOC teams are also responsible for assessing and enforcing security policies. SOC teams monitor the entire organization, not just one system in a specific department.

 

SOCs must be customizable to the different security needs of each organization. There are several types of SOCs:

 

●      Internal—includes in-house security professionals

●      Managed—includes third-party professionals working remotely

●      Co-managed—a combination of internal and third-party professionals

●      Command—useful for large enterprises that manage and coordinate smaller SOCs

How Do Security Operations Centers Work?

Organizations have to define their security strategy first and then provide appropriate infrastructure for the SOC team. Security Information and Event Management (SIEM) systems are the main part of SOC activity. SIEM systems collect events and logs from multiple security tools and organizational systems. The SOC team then analyzes the data from SIEM and generates actionable security alerts.

 

The SOC team include the following roles:

 

●      Security analyst—in charge of detecting and handling potential security threats. Analysts also implement security measures and are involved in disaster recovery plans.

●      Security engineer—usually a software or hardware specialist that is responsible for updating and maintaining systems and tools. Security engineers are also responsible for documentation needed by other team members, like protocols.

●      SOC manager—responsible for the operation and management of the SOC team. SOC manager’s responsibilities include synching between engineers and analysts, hiring and training new team members, and planning a security strategy. In addition, they direct and orchestrate the response to major security issues.

●      Chief information security officer (CISO)—creates security-related policies, strategies, and operations. Works closely with the Chief Executive Officer (CEO), informs and reports to management on security threats.

●      Director of incident response—responsible for managing incidents in large companies. Reports on security requirements to the organizational management in the case of a major breach.

 

SOC analysts are organized in four tiers:

 

●      Tier 1 analysts—monitor, prioritize and investigate SIEM alerts.

●      Tier 2 analysts—usually have deeper security experience. They analyze real threats and decide on a strategy for containment.

●      Tier 3 senior analysts—manage critical breaches and are responsible for threat hunting and vulnerability assessment.

●      Tier 4 analysts—SOC managers responsible for recruitment, security strategy, and reporting to management when major security incidents occur.

The Difference Between a SOC Team and a CSIRT?

A Computer Security Incident Response Team (CSIRT) is in charge of receiving, analyzing, and responding to security threats. CSIRTs can work as a standalone team operating under SOCs. Both SOC and CSIRT are responsible for minimizing the damage during security incidents.

 

The difference between detection and response is not always clear, and may even become irrelevant. As a result, organizations often prefer to have a unified team of SOC and CSIRT. For instance, threat hunting identifies threats and operates as a method of response.

 

Security Orchestration, Automation and Response (SOAR) tools are another reason for merging SOC and CSIRT teams. Companies often cannot decide who owns SOAR tools and who is responsible for their evolution.

 

Threat intelligence activities can also support the efforts of a single team. A single threat intelligence dashboard can offer insights into more effective identification and response methods.

 

Tier 1 SOC analysts usually work weekends and night shifts. SOC management is struggling to keep them motivated. By merging SOC and CSIRT, you can enable more effective job rotation.

 

Some experts believe that keeping CSIRT and SOC teams separate enables them to concentrate on their core goals of detection and response. Organizations often prefer to keep incident response centralized in-house due to the sensitivity of investigation results even when there are multiple regional offices.

 

Strategic plans for outsourcing may also demand the separation of these two teams. Keeping CSIRT and SOC separate may help an organization clearly define the responsibilities of a partner.

Benefits of Security Operations Centers

There are many benefits a business can gain from using a SOC in their security strategy. Discussed below are the main four benefits:

 

●      Centralized display of assets—centralized and continuous SOC monitoring helps companies maintain smooth operations by visualizing and detecting issues as they occur.

●      Establishing client and employee trust—employees and consumers need to know that their information is safe. Data loss prevention measures in a SOC help organizations improve and maintain brand integrity in the long run.

●      Collaborating across departments and functions—SOCs encourage other departments to work together towards a common goal when dealing with incidents. As a result, the coordination and communication between different teams improve and they can resolve the issue collectively.

●      Reduce costs—SOCs help maintain the integrity of sensitive information, save money in the long run and help in avoiding the cost of significant recoveries from data loss.

Challenges of Security Operation Centers

SOCs also have many challenges they need to tackle in order to continue being a vital part of security:

 

●      Security alerts—the growing number of security alerts may affect the efficiency of security analysts. Analysts may attend to routine tasks instead of the urgent ones when determining the accuracy of alerts. As a result, they can miss important alerts.

●      Multiple security tools—SOCs and CSIRTs use many different security tools. As a result, organizations cannot efficiently monitor all the data generated by these tools. A Security Information and Event Management (SIEM) platform can help SOCs in collecting and analyzing data from multiple sources.

●      Resource allocation—organizations sometimes decide to outsource SOCs when there is a lack of qualified professionals. However, remote working conditions can lead to greater vulnerabilities.

 

IT infrastructure is an integral part of any company. Therefore, organizations need to ensure that their IT infrastructure and valuable information is well protected. SOC teams provide deep insights into an organization's security posture and recommend required measures to ensure the security of IT infrastructure. SOCs prevent costly data losses in case of a cyber-attack by proactively detecting incidents and ensuring optimum safety.

About the Author

Gilad David Maayan is a technology writer who has worked with over 150 technology companies including SAP, Imperva, Samsung NEXT, NetApp and Ixia, producing technical and thought leadership content that elucidates technical solutions for developers and IT leadership. Today he heads Agile SEO, the leading marketing agency in the technology industry.

Featured

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

  • DHS to End ‘Shoes-Off’ Travel Policy

    Homeland Security Secretary Kristi Noem announced a new policy today which will allow passengers traveling through domestic airports to keep their shoes on while passing through security screening at TSA checkpoints. Read Now

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.