SOC Technology and Best Practice

Published in

The Startup

5 min readNov 23, 2020

SOC technology and Best Practice

Hi Medium! Here we are again with a new article, today we will talk about SOC technology and Best Practice. We are going to discover :

+ What is SOC?
+ Why is SOC Important?
+ SOC Management
+ Best Practice
+ Conclusion

1- What is SOC?

SOC (Security Operation Center), is a division within a security cell, which ensure the security of the organization, at technical and organizational levels.
In a building, a SOC is a place from which employees supervise the site with specific data processing software, monitor access, control power, alarms, etc…
Through a well-configured SOC, the company can ensure business continuity and anticipate potential problems and incidents, because firewalls and intrusion detection system (IDS) are not always sufficient

2 — Why is SOC Important?

Among the benefits of a SOC:

+ Speed of response time (effective for example in the case of Malware, given its speed of propagation)
+ Ability to recover from a DDOS attack in a reasonable amount of time (Distributed Denial of Service)
+ Faster identification of potential attacks and abort before they cause damage

Security Information Management (SIM), Security Information Management Event (SIEM you can check this article), Security Event Management (SEM), are essential solutions for the successful implementation of a SOC. These tools, flexible and agile, consolidate the data (logs, alerts, logs) and analyze them rigorously for visual use.

SIMs allow collection, aggregation, standardization, correlation, reporting, archiving, and replay events

3 — SOC Management

Good supervision of a SOC is a key factor for its success. Analysts, staff, hardware, and software are also key elements, but the ultimate success of a SOC is based on the skills of its manager. Weak or inadequate management can have disastrous consequences in terms of performance, neglected incidents, or improperly followed processes.

One of the other key success factors of a SOC is the implementation of a good monitoring strategy. In order to ensure the good management and the good actions of a SOC, it is obligatory, in a document, to define the perimeter, the technical architecture, the processes of monitoring and maintenance, the rules of the SOCs, the points of contacts, all on the basis of knowledge and the monitoring of the project.

The main purpose of a SOC is to ensure the proper monitoring of the catalog and computer park.
I love this graph and I want to share it with you :

4 — Best Practice

Classifying SOC Investments and Defining Roles

The budget largely depends on the delivery model. While the general IT staff can manage the SOC platform, security administrators and analysts must handle security incidents. These two roles require vastly different sets of skills and expertise. The security leaders overseeing the SOC must also have a thorough understanding of who is responsible for what. Administrative tasks include resetting passwords and managing the SIEM, while maintenance tasks include installing patches and ensuring that security controls are properly configured.

Maximizing Incident Response Capabilities

The most important thing is to watch the availability of the security incident response team (CSIRT), the SOC team can be as proactive as possible, they can use cognitive technologies to analysts quickly the attack pattern and stop it. saving both money and invaluable time.
While a security administrator can analyze offenses, manage security incidents, and install patches, these tasks are particularly time-intensive. During the time it takes to examine a security event, attackers can generate new threats and infiltrate other areas of the network. For this reason, a CSIRT is more capable of managing threats to the entire system. Some individuals on the team might have multiple responsibilities, but it’s important to clearly define those roles.

Defending the Perimeter

One of the primary directives of a SOC team is to identify and defend the perimeter, but what information do the analysts need to collect? Where is the information located?

The SOC team should consider :

Network information, such as hashes, URLs, connection details, etc.
Vulnerability information reported by vulnerability scanners
Security intelligence feeds
Topology information
Web proxy URL
External-facing firewall
Antivirus
Virtual private networks (VPNs)
Radius/Lightweight Directory Access Protocol (LDAP)
Endpoint monitoring
Domain name system (DNS)
Dynamic Host Configuration Protocol (DHCP)
Intrusion prevention (IPS) and detection (IDS) systems
Operating systems (OSs)
Other syslogs

It goes without saying that reducing the amount of data collected negatively impacts analysts’ ability to detect incidents and minimize false positives. Furthermore, more sophisticated attacks usually require more context to successfully detect. This is why it’s crucial to implement both physical and logical segmentation. The same goes for configuration management — if not properly optimized, some data sources might induce management difficulties. While using fewer sources can simplify the management of this data, it also reduces the SOC’s detection capabilities.

5 — Conclusion: First Line of Defense: The Security Operations Center

Designing a SOC is not as simple as installing a SIEM and watching the gears turn. In addition to investing in the right technologies, security leaders must ensure that their strategy aligns with human factors and business needs. They must also make sure their analysts are focusing on collecting the right data.

In today’s volatile cybersecurity landscape, the SOC team is the first line of defense against rapidly evolving threats. The better-equipped analysts are to efficiently manage these threats — and the more security leaders are able to demonstrate the value of the SOC to business leaders — the safer corporate data will be from sophisticated cybercriminals looking to exploit it.