People

Employing a resourceful team is the foremost step in building a Cyber Security Operation Center. SOCs are staffed with a variety of individuals that play a particular role in overarching security operations.

The SOC is only as good as its people, and upfront planning for the unique people management aspects of a 24×7 security-centric organization will provide significant long term returns.

Points of Consideration:

-SOC staff have a specialized skill set and experienced staff are often difficult to find
-Training is expensive, time-consuming, and improves marketability of staff. Compensation strategies must be evaluated accordingly.
-Retention of staff is difficult in a non-security centric organization due to continuous need for updated training, lack of expansive career path options, and burn-out.

Technology

Identifying the tools you need effective detection and response is one of the main parts of the whole framework of building SOC. You want the tools that will support your strategy for visibility across your network and incident reponse

Cutting-edge technology
We will utilise a range of security tools and technologies to help detect unknown, sophisticated and evasive cyber threats. Network monitoring and log management systems form a vital part of a CSOC’s armoury. Threat detection technologies deployed within a SOC typically include:

SIEM
Security Information and Event Management (SIEM) technologies provide a holistic view of cyber security posture through the collection, aggregation and correlation of log and event information.

Intrusion Prevention Systems
Intrusion Prevention systems (IPS) complement SIEM by combining network and host-based methods to detect and prevent suspicious behaviour on a network.

Vulnerability scanning
Active vulnerability scanning ensures weaknesses can be identified and addressed before they are exploited by hackers.

Endpoint detection
Endpoint detection systems analyse activity at a device level to provide greater visibility of threats, help trace the root cause of attacks and facilitate swifter incident remediation.

Process 

Prior to the development of SOC, a set of rules should be defined to state the ownership and streamline all product, In order to build a more formal and centralized organization.

SOC processes must be documented, consistently implemented, and based upon existing standards/governance frameworks. Procedures must take into consideration corporate security policy, business controls, and relevant regulatory requirements.

Points of Consideration:

-The SOC’s mission must be clearly defined
-Incident discovery, CERT, etc.
-SOCs differ from NOCs, and an alarm does not always equate to action.
-Processes must take into consideration evaluation and incorporation of a constantly changing stream of potentially actionable threat intelligence.
-Best practices for incident investigation, response, and mitigation must be maintained and updated as technologies are added, change, or mature.