A SOC because you must, or because you want to
Jun 14th, 2021 by Jesper Kråkhede
There are two reasons companies get a SOC. Because they must, or because they want to.
The first kind is bought to satisfy a regulator, an auditor or a customer. The requirement says ‘continuous security monitoring’, so a service is purchased, preferably the cheapest one that ticks the box. It collects some logs, sends a monthly report and nobody really reads it.
The second kind is part of the security work. It is connected to the rest of the security organisation, it knows the environment, it has the mandate to act, as I wrote in my previous post, and what it finds is used to improve the protection. When the SOC sees the same type of attack three times, someone fixes the hole.
The cost of the two is not as different as you might think. The big difference is in how you use it.
So for management: Look at your SOC and ask a few questions. When did it last stop an attack, not just report one? What did we change in our environment because of something the SOC found? Does the SOC know which of our systems are the most critical? Can it act without waiting for us?
If you can´t answer those, you probably have the first kind.
A SOC is not a cost of compliance. It is your eyes and hands when something goes wrong.