Should You Invest in a SOC?

IT managers, directors, and executives are feverishly planning their budgets as the end of the year draws near. If you are like most, you have several scenarios in mind like upgrading servers, extending software licensing agreements, and adding new technology to your stack.

You may even be considering what could be the largest line item on your budget, and hopefully most beneficial: building a Security Operations Center.

SOCs can be extremely beneficial as they provide continuous monitoring, real-time analysis of incidents, and quicker time to respond. They’re also problematic when it comes to cost and personnel.

Weighing the SOC Options

Before you summarily dismiss the notion of building a SOC due to complexity and cost, let’s consider your options.

First, for enterprise businesses with larger budgets, building and maintain a SOC could be the right choice. If you’re going down the internal route, you’ll need to:

• Buying/leasing/re-purposing office space
• Procuring hardware and software
• Defining network architecture
• Hiring security analysts
• Investing in training for this staff on your selected tools
• Developing run books and incident response plans
• Identifying and integrating threat intelligence feeds

This approach is not for the faint of heart as getting a SOC operational is no easy task. You will hit snags along the way that could impact your bottom line. Nevertheless, if you have the budget and commitment from all stakeholders involved, building your own SOC gives you control of security monitoring and incident response.

The other option is outsourcing your SOC as part of an overall security solution. With this option, you utilize the SOC that’s included with your managed security service solution. Their team takes ownership and responsibility for monitoring your security framework as well as responding to incidents. This can be a great option for lean organizations wanting to focus their investments on their business, shedding tasks that are not directly related to their core competencies.

Gartner published a great research note outlining what they call The Five Models of Security Operations Centers. This is definitely worth the read as it provides a roadmap of sorts that companies can use to determine if they need a SOC and what type makes sense for them.

Next year and every year going forward, your security will be tested. Make sure you have a SOC as part of your strategy.