Security Operations Center (SOC).

What is a security operations center?

A security operations center, or SOC, is the team and the place that watches an organization’s systems for cyber attacks and deals with them. NIST describes a SOC as the focal point for security operations and computer network defense for an organization.

What does a SOC do?

NIST SP 800-53 says the purpose of a SOC is to defend and monitor an organization’s systems and networks on an ongoing basis. It also says the SOC is responsible for detecting, analyzing and responding to cybersecurity incidents in a timely manner. A cybersecurity incident is an event that harms, or may harm, the security of a system or its data.

The same NIST document says a SOC uses monitoring, scanning and forensics tools to monitor, fuse, correlate, analyze and respond to threat and security-relevant event data from multiple sources. It names perimeter defenses, network devices such as routers and switches, and endpoint agent data feeds as examples of those sources. NIST adds that the SOC provides a holistic situational awareness capability. This helps an organization judge the security posture of its systems.

Who works in a SOC?

NIST says an organization staffs its SOC with skilled technical and operational personnel. Its examples are security analysts, incident response personnel and systems security engineers. NIST also says these staff work with a mix of technical, management and operational controls.

How does a SOC fit into incident response?

NIST SP 800-61 Revision 3 describes incident response as part of wider cybersecurity risk management. In its Detect function, NIST says possible cybersecurity attacks and compromises are found and analyzed. It says this work includes continuous monitoring.

In the same guide, NIST gives alerts as an example. It recommends generating alerts and providing them to cybersecurity and incident response tools and staff, and it names the SOC and incident responders as examples of that staff. NIST also lists tools such as SIEM and SOAR as automated means to estimate the impact and scope of adverse events. A SIEM collects log records from many systems in one place. A SOAR tool helps automate response steps.

Does every organization run its own SOC?

NIST says a SOC capability can be obtained in a variety of ways. It says larger organizations may implement a dedicated SOC, while smaller organizations may employ third-party organizations to provide such a capability. NIST SP 800-61 Revision 3 gives a similar example. It says an organization’s incident handlers might be on contract, such as when a SOC is outsourced to a managed security services provider.

Is a SOC the same as an incident response team?

No. NIST describes the SOC as the focal point for security operations and computer network defense. In NIST SP 800-61 Revision 3, the SOC and incident responders are named as separate examples of the staff who receive alerts.

Is a SOC the same as a SIEM?

No. A SOC is a team with a function. A SIEM is a tool that the team may use. NIST SP 800-61 Revision 3 names SIEM as one automated means to estimate the impact of adverse events, which sits alongside manual means.