Modern-Day SOCs: People, Process & Technology

As security operations centers (SOCs) continue to evolve, enterprises are challenged with enhancing their ability to detect cyberthreats and keep themselves from harm, according to a recent report about building successful SOCs from the ISF.

If They Build It, Visibility Will Come

The question of, “What’s the right way to do it?” is a natural inquiry when building pretty much anything. When it comes specifically to a SOC, focusing on the elements that can drive a program’s maturity should be the foundation from which a security team starts

Organizations are all too familiar with the risk of financial loss, customer attrition, and reputational damage that comes from a data breach, which is why they can no longer afford to rely solely on reactive measures, says Steve Durbin, managing director of the ISF.

The security operations priority must be to identify threats, resolve security issues, and prevent adversaries from disabling or degrading business operations. “Without a SOC, organizations lack real-time visibility of threats, impeding their ability to protect business critical assets and effectively manage information risks,” Durbin says.

A number of practical considerations, including understanding the capabilities that can be provided by a SOC and whether a business case to initiate a SOC implementation exists, should frame an organization’s approach to investing in its operations center. The challenge, however, is that each new system then requires expertise to configure and use it.