Establishing IT Infrastructure Through Security Operations Centers

How to improve client and employee trust, collaborate across departments and reduce costs through SOCs

• By Gilad David Maayan
• Apr 07, 2020

Small companies face a harsh reality: As much as 60 percent of small and medium-sized businesses that are hacked fail within six months of the cyber attack. Organizations need to have a cybersecurity strategy in place to identify and mitigate any potential threats. While there are many strategies to secure your business, a Security Operations Centers (SOC) can truly expand your vulnerability detection capabilities. This article reviews the benefits and challenges of a modern SOC and the differences between a SOC and a Computer Security Incident Response Team (CSIRT) team.

What Is a SOC?

A security operations center is a team of people who are responsible for identifying security issues and incidents, monitoring systems and responding to events. SOC teams are also responsible for assessing and enforcing security policies. SOC teams monitor the entire organization, not just one system in a specific department.

SOCs must be customizable to the different security needs of each organization. There are several types of SOCs:

●      Internal—includes in-house security professionals

●      Managed—includes third-party professionals working remotely

●      Co-managed—a combination of internal and third-party professionals

●      Command—useful for large enterprises that manage and coordinate smaller SOCs

How Do Security Operations Centers Work?

Organizations have to define their security strategy first and then provide appropriate infrastructure for the SOC team. Security Information and Event Management (SIEM) systems are the main part of SOC activity. SIEM systems collect events and logs from multiple security tools and organizational systems. The SOC team then analyzes the data from SIEM and generates actionable security alerts.

The SOC team include the following roles:

●      Security analyst—in charge of detecting and handling potential security threats. Analysts also implement security measures and are involved in disaster recovery plans.

●      Security engineer—usually a software or hardware specialist that is responsible for updating and maintaining systems and tools. Security engineers are also responsible for documentation needed by other team members, like protocols.

●      SOC manager—responsible for the operation and management of the SOC team. SOC manager’s responsibilities include synching between engineers and analysts, hiring and training new team members, and planning a security strategy. In addition, they direct and orchestrate the response to major security issues.

●      Chief information security officer (CISO)—creates security-related policies, strategies, and operations. Works closely with the Chief Executive Officer (CEO), informs and reports to management on security threats.

●      Director of incident response—responsible for managing incidents in large companies. Reports on security requirements to the organizational management in the case of a major breach.

SOC analysts are organized in four tiers:

●      Tier 1 analysts—monitor, prioritize and investigate SIEM alerts.

●      Tier 2 analysts—usually have deeper security experience. They analyze real threats and decide on a strategy for containment.

●      Tier 3 senior analysts—manage critical breaches and are responsible for threat hunting and vulnerability assessment.

●      Tier 4 analysts—SOC managers responsible for recruitment, security strategy, and reporting to management when major security incidents occur.

The Difference Between a SOC Team and a CSIRT?

A Computer Security Incident Response Team (CSIRT) is in charge of receiving, analyzing, and responding to security threats. CSIRTs can work as a standalone team operating under SOCs. Both SOC and CSIRT are responsible for minimizing the damage during security incidents.

The difference between detection and response is not always clear, and may even become irrelevant. As a result, organizations often prefer to have a unified team of SOC and CSIRT. For instance, threat hunting identifies threats and operates as a method of response.

Security Orchestration, Automation and Response (SOAR) tools are another reason for merging SOC and CSIRT teams. Companies often cannot decide who owns SOAR tools and who is responsible for their evolution.

Threat intelligence activities can also support the efforts of a single team. A single threat intelligence dashboard can offer insights into more effective identification and response methods.

Tier 1 SOC analysts usually work weekends and night shifts. SOC management is struggling to keep them motivated. By merging SOC and CSIRT, you can enable more effective job rotation.

Some experts believe that keeping CSIRT and SOC teams separate enables them to concentrate on their core goals of detection and response. Organizations often prefer to keep incident response centralized in-house due to the sensitivity of investigation results even when there are multiple regional offices.

Strategic plans for outsourcing may also demand the separation of these two teams. Keeping CSIRT and SOC separate may help an organization clearly define the responsibilities of a partner.

Benefits of Security Operations Centers

There are many benefits a business can gain from using a SOC in their security strategy. Discussed below are the main four benefits:

●      Centralized display of assets—centralized and continuous SOC monitoring helps companies maintain smooth operations by visualizing and detecting issues as they occur.

●      Establishing client and employee trust—employees and consumers need to know that their information is safe. Data loss prevention measures in a SOC help organizations improve and maintain brand integrity in the long run.

●      Collaborating across departments and functions—SOCs encourage other departments to work together towards a common goal when dealing with incidents. As a result, the coordination and communication between different teams improve and they can resolve the issue collectively.

●      Reduce costs—SOCs help maintain the integrity of sensitive information, save money in the long run and help in avoiding the cost of significant recoveries from data loss.

Challenges of Security Operation Centers

SOCs also have many challenges they need to tackle in order to continue being a vital part of security:

●      Security alerts—the growing number of security alerts may affect the efficiency of security analysts. Analysts may attend to routine tasks instead of the urgent ones when determining the accuracy of alerts. As a result, they can miss important alerts.

●      Multiple security tools—SOCs and CSIRTs use many different security tools. As a result, organizations cannot efficiently monitor all the data generated by these tools. A Security Information and Event Management (SIEM) platform can help SOCs in collecting and analyzing data from multiple sources.

●      Resource allocation—organizations sometimes decide to outsource SOCs when there is a lack of qualified professionals. However, remote working conditions can lead to greater vulnerabilities.

IT infrastructure is an integral part of any company. Therefore, organizations need to ensure that their IT infrastructure and valuable information is well protected. SOC teams provide deep insights into an organization's security posture and recommend required measures to ensure the security of IT infrastructure. SOCs prevent costly data losses in case of a cyber-attack by proactively detecting incidents and ensuring optimum safety.