Building a Resilient Security Operations Center (SOC)

The FBI fields more than 2,000 cyberattack reports every day. Extreme weather events are happening with increased frequency. And mass shootings have become tragically common occurrences.

Ransomware, hurricanes, and gun violence might seem disconnected. But taken together, these statistics represent the increasingly volatile threat landscape that businesses operate in today. Whether you’re a regional delivery company or an international e-commerce brand, your organization faces a wide array of security threats.

To protect your company’s resilience, you need resources dedicated to understanding, mitigating, and responding to these threats. This is where a security operations center (SOC) can help. But what exactly is a SOC, and how do you put one together?

Learn why your organization needs a robust security operations center and how to successfully build, staff, and leverage a SOC to improve business resilience.

What Is a Security Operations Center?

A security operations center is an operational unit whose focus is monitoring and improving an organization’s security posture. While the term has traditionally referred to a physical location—a security command center—the rise of virtual and remote workplaces has moved the focus from on-premises location to functional purpose. In some cases, security operations centers are responsible for only cybersecurity, but it has become more common for SOCs to take responsibility for a company’s entire security posture, monitoring physical threats to facilities and employees in various locations, as well as incident response and management.

A SOC’s specific functions will vary from company to company, but it usually fulfills several key roles within an organization:

• Proactive security monitoring: This covers everything from watching security cameras and other monitoring tools to network and server log management, in an attempt to uncover suspicious activity that could be a threat.
• Incident response coordination: During and immediately after an incident, the SOC will act as a central point of contact for both internal and external stakeholders, providing information and directing resources as needed.
• Security remediation and improvement: SOC analysts can use penetration testing (a form of authorized simulated cyberattack) to detect vulnerabilities in your physical or digital infrastructure and recommend curative measures.
• Communication and intel: A SOC can aggregate disparate sources of threat intelligence and apply context, allowing them to provide concise and actionable communication to every level of your organization.

Why Your Company Needs a SOC

An in-house security operations center might seem redundant if your company already performs many of the same functions. For example, your network operations center (NOC) is probably aware of cyber threats and has an incident response process in place. But broader SOC services help your company prioritize security with a more thorough, proactive, and overarching approach to these issues.

Here are four ways that a SOC can improve your organization’s security and threat intelligence.

1. Manage risks to information systems

Nearly every business depends on secure digital systems, regardless of industry. With that in mind, proactive cybersecurity is critical to managing risk. While NOCs are generally focused on protecting your network from downtime due to environmental or technical issues, SOCs focus on bad actors and other cybersecurity incidents.

A SOC works closely with IT and telecom personnel to ensure your digital systems are as secure as possible by:

• Locking down firewalls as tightly as possible and regularly auditing for gaps
• Keeping antivirus software current to minimize the risk of malware or ransomware entering your network
• Performing regular penetration testing to identify vulnerable endpoints
• Investigating cyberattacks thoroughly and determining how best to prevent future breaches

2. Facilitate emergency response

A SOC is uniquely positioned to orchestrate the response during and after an emergency. As an event unfolds, the SOC will have the most up-to-date information and can make rapid decisions or escalate to company leadership as necessary.

A tornado is one example of where a SOC can improve emergency response. Many tornadoes have a limited warning, on the scale of minutes. From there, your SOC can spring into action and drive the response:

• Immediately push out a warning via SMS to any team members in impacted areas, advising them to seek shelter
• Monitor the tornado’s path via public channels
• If the storm hits a company facility, collect calls for help and updates from employees at the site and coordinate with first responders
• Pass updates to company leadership that will allow them to make decisions on continuing or halting operations at nearby sites
• Once the immediate threat has passed, investigate the effectiveness of internal safety procedures and update them as needed

3. Improve business resilience

Threat intelligence is one of the key aspects of business resilience. Specifically, you need a team that can quickly and efficiently triage threats and respond accordingly, and SOCs excel in that regard. When a threat is active, that team can escalate immediately and minimize the impact on your business. Conversely, they can quietly handle low-risk threats rather than sounding the alarm, preventing organization-wide alert fatigue.

Improved resilience can benefit any company, but it’s especially important for organizations operating in high-risk environments. The International Justice Mission (IJM) is a worldwide anti-slavery organization operating 29 offices in 19 countries, employing over 1,000 staff members. Their personnel often work in high-risk environments with limited local resources to handle emergencies. AlertMedia’s threat intelligence platform has allowed IJM’s global security operations center to streamline the process of monitoring and communicating with their teams, helping to keep them safe during rapidly evolving situations.

4. Coordinate best practices and compliance

Regulatory burden is an expensive but necessary undertaking for many companies. Depending on your industry, you might have to worry about compliance with OSHA, DPR, HIPAA, PCI DSS, a variety of ISO guidelines, or any other number of standards.

Centralizing security-related compliance with your SOC achieves two primary goals:

1. It takes excess work out of other teams’ hands, freeing them up to focus on their core mission for your organization.
2. It puts compliance in the hands of expert security professionals, allowing them to set internal guidelines that make sense for your company.

Tasking your SOC with compliance has the added benefit of eliminating gaps that department-oriented initiatives might create. Your SOC has a 360-degree view of your organization, meaning they can keep every team in sync and ensure consistent security measures at every step.

How to Build and Scale a SOC

Whether you’re building out a new SOC from scratch, or scaling an existing facility, the goal is always the same—to better meet your organization’s security needs.

For most companies, the process is an iterative feedback loop:

• Collaborate with key stakeholders like the COO, CTO, and CIO to determine how you can support and serve their teams
• Expand your SOC’s capabilities accordingly
• Assess the impact of your improvements and determine the next steps for improvement

Starting a brand new SOC can feel daunting, especially if you’re accustomed to fully furnished and large-scale security centers. But the best approach is to start small and build from there. Make a list of the bare necessities for your organization, find a space to set up shop, consider staffing, and get started. Having your SOC running—even in an imperfect state—will make the improvement process easier in two key ways:

• Iterating based on empirical evidence that you collect in your SOC’s early days allows for more precise decisions on new equipment, security tools, and personnel
• Establishing value for the company will make it easier to secure funding and organizational buy-in on expansion projects

There are three main areas to consider when implementing or expanding your SOC.

1. Physical Space

Unless your organization’s workplace is completely virtual or you’re outsourcing your SOC, you’ll need to provide a space for the unit. What the space looks like depends on how big your SOC team is, your organization’s line of work, and the location in which they’ll operate.

For example, consider an oil company that operates offices with SOCs in locations prone to civil unrest. They’d need to consider physical hardening and security measures that would allow them to be isolated from the external environment. Conversely, a consulting firm in Silicon Valley doesn’t realistically face many physical threats and can focus its SOC facility on practicality and utility.

One challenge that many small or growing companies face is finding the ideal space for a new department. Office space is probably at a premium and you have to weigh investing in growth against a new SOC. In general, it’s better to find a space rather than the perfect space. Build out a SOC where you can and let your company’s trajectory dictate how you expand the facility in the future.

From there, your company’s operations will dictate what sort of investments make sense. Here are some of the most popular and useful platforms SOCs can leverage:

• Security information and event management (SIEM) solutions: SIEM systems automate and streamline many of the tasks involved in log management and threat detection, allowing your analysts to focus on acute risks instead of mundane tasks.
• Threat intelligence providers: Platforms that aggregate and validate disparate sources of information can help your team make faster and more informed decisions in responding to threats.
• Communication tools: A two-way communication platform allows your SOC to push updates out to your entire workforce, monitor employees’ safety, and keep tabs on evolving situations.

3. Staff

Last but not least, you need a SOC team. Depending on the size of the company, your CSO or Director of Security might run the unit themselves, but bigger organizations usually have a dedicated SOC manager.

As you build out your team of security officers, there are several key qualities to look for:

• Experience multitasking in fast-paced environments
• Strong listening and communication skills
• The ability to make decisions quickly and confidently
• Knowing when to escalate to internal or external stakeholders

Most importantly, your SOC team needs to be built around the idea of integrating smoothly into the company and maintaining a positive working relationship with other departments. If your SOC team members are feared or viewed as outsiders, it will be difficult to break down organizational silos and establish cohesive procedures.

Centralizing and Streamlining Organizational Resilience

Your organization faces a variety of threats every day, be they digital or physical, big or small. Resilience management is critical to protecting your company, and no one is better positioned to spearhead that process than a security operations center. Where department-led initiatives might create gaps, a SOC can meet organization-wide needs with a comprehensive and cohesive plan.

As a safety leader, you hope your SOC team’s workload is routine and you never need to use the full extent of their expertise. But if disaster does strike, you can be confident you have the right people and resources to guide your organization to the best possible outcome.