Managed 24/7 SOC

SOC with a team of analysts remains one of the most effective tools for preventing cyber attacks. However, creating and maintaining a SOC within an organisation means high maintenance costs. Checking, hiring, building and continuously training a team of specialists is a challenging task. In addition, employees may leave the company.

It is a security operations centre with analysts actively monitoring and analysing cybersecurity events on 24/7 basis. The analysis rejects misleading and irrelevant reports, so that only real threats are reported.

Cyberspace never sleeps – even when employees turn off their computers, servers and other equipment are still running. With SOC analysts working on 24/7 basis, threat monitoring time is extended by up to 4 times to cover both off-hours and weekends.

Creating a 24/7 SOC requires the creation of continuous and non-overlapping shifts of analysts. This requires a minimum of 4 competent analysts who are able to work independently.

Managed Detection and Response (MDR) is gaining traction around the world as an alternative to SOC services. The key difference between these two concepts is that an MDR service provider provides not only monitoring and information functions, but also automated or manual response capabilities. These developments are mainly influenced by the recent popularity of EDR, XDR and NDR tools, which detect and report certain anomalies in an automated way and react automatically in emergency situations. However, no matter how advanced the technology and its automation, certain ‘grey area’ events still need to be analysed by a security analyst, as there are often cases where it is not possible to make an unambiguous automated decision on whether a security breach has occurred or not. Often, the resulting security events require in-depth analysis, specific expertise and a human understanding of threat trends and the IT infrastructure being monitored, which is extremely difficult to automate. The greatest value of a 24-hour SOC is when real analysts are monitoring cyberspace around the clock, supported by state-of-the-art security technology.