Security Operations Center in a few sentences
ICT security monitoring, or what?
Networks, servers, network devices, workstations, firewalls and a slew of other devices work together to make our IT services / information systems work properly. Current attacks on infrastructure have changed in nature, are not as obvious and staid as before, and require ongoing observation. Also, undesirable behavior by our employees and co-workers requires much more activity on our part.
Why protect / monitor?
There are many reasons why we should protect our ICT assets. They are of great value to our organization. Production systems, control systems, accounting systems, customer service systems, process vital data. Access to them, and their integrity and authenticity, affects the decisions we make.
Internal users, sometimes consciously and sometimes not, hackers, sometimes for money and sometimes for sport carry out increasingly complex activities. They often last for weeks, months and are very difficult to catch with ad hoc monitoring.
Are your physical assets not secured, are they not protected by specialized security, are you leaving the door open? Perhaps without IT systems and data, your operation will prove impossible or difficult?
Sometimes the monitoring decision is driven by legal requirements: National Cyber Security System, National Interoperability Framework, personal data protection and others.
What does this service consist of?
It involves hooking up probes, SIEMa to the infrastructure and ongoing monitoring of non-standard events, system and user behavior. Of course, this is related to vulnerability analysis, assessing what is happening on the Internet and analyzing traps – honeypots. The SOC identifies incidents, analyzes their causes and possible effects, identifies problems, informs those responsible for the infrastructure, and proposes and implements improvements. The professional Security Opertion Center performs a range of additional services: system and infrastructure testing, social engineering testing, auditing, hardening and many other security activities.
Do I have to have a brewery to drink beer? Do I hire my own security guard, or do I hire a security company? Of course, the answer is not clear-cut and depends on the size of the infrastructure to be monitored.
However, due to the increased cost of hiring IT and cybersecurity experts, the difficulty of training, and the professionalization and need for employee development, even the largest companies are choosing to purchase an outside service.
This allows for proper scaling of the service and the ability to focus on core business. A professional SOC supports dozens / hundreds of customers, which gives additional value related to the ability to quickly solve known problems.
The right choice of SOC operator also ensures the right level of customization of the service.
First, we need to decide what to monitor? Mail, ERP systems, CRMs, we need to determine what is most important to us, as well as certain vectors of possible adverse events.
Secondly, it is necessary to determine how we monitor? What SIEM is worth using, do we have other tools that provide information about events. A professional Security Operation Center can perform its tasks based on any SIEM. Alien Vault, QRadar, Splunk are just examples of the systems we support.
Third, it is necessary to decide when do we monitor? Is it 24 hours a day, or perhaps when our IT support organization is not operating, that is, outside of business days (Out of Business Day), or perhaps only when we and our customers are active (In Business Day)
Fourth , who does the monitoring? What kind of work do we do internally and what kind of work do we outsource?
In the end, action remains. Launching your own Security Operation Center means months of team building and working out the processes of operation. The professional external Security Operation Center gains operational efficiency after 2/4 weeks of cooperation.
Absolutely not, in the SOCaaS (SOC as a Service) model, part of the service is also the provision of appropriate monitoring tools.
This eliminates the need to purchase a system. In this model, we can use open source or commercial probes and systems.
Our Security Opertion Center works in very different environments, using a variety of in-house tools as well as those owned by our clients.
They just as much as any other, and sometimes even more in need of monitoring. The professional Security Operation Center has experts in industrial systems and can monitor these systems.
We develop monitoring concepts, implement SIEM, and conduct monitoring according to the mode you have adopted, including 24 hours per 365 days.
In addition to monitoring, we provide a range of additional security services including NOC – network management center.
Related blog articles
PoC przeprowadozny z narzędziem monitorowania systemów SCADA zapalił nam żółtą lampkę. Skąd tak dziwny ruch w naszych teoretycznie sterylnych sieciach.
Krajowy System Cyberbezpieczeństwa to wymagania dla operatorów usług kluczowych oraz usług cyfrowych. Czym są te wymagania opisane w dość oszczędny sposób w Ustawie? Co mówi sama ustawa o tym jak zapewnić bezpieczeństwo i ciągłość realizacji usług kluczowych?
11 stycznia pojawiła się kolejna informacja o administracyjnej karze pieniężnej w wysokości 45 tys. złotych. Kara ta po raz kolejny związana jest niezastosowaniem przez Administratora odpowiednich środków technicznych i organizacyjnych mających zapewnić zdolność do ciągłego zapewnienia poufności usług przetwarzania, także za brak regularnego testowania, mierzenia i oceniania skuteczności środków.
