Cyber security operations centre concepts and implementation

Cyber Security Operations Centres (SOCs) are attracting much attention in recent times as they play a vital role in helping businesses to detect cyberattacks, maintain cyber situational awareness and mitigate real-time cybersecurity threats. Many literatures often cite the monitoring of an enterprise network and the detection of cyberattacks as a core function of a SOC. While this may be true, a SOC offers more functions than the detection of cyberattacks. For example, a SOC can provide functions that focus on helping an organisation to meet regulatory and compliance requirement. A better understanding of the functions that could be offered by a SOC is useful as this can aid businesses running an in-house SOC to extend their SOC capabilities to improve their overall cybersecurity posture. The goal of this chapter is to present the basics one needs to know about SOCs. The authors introduce readers and IT professionals who are not familiar with SOCs to SOC concepts, types of SOC implementation, the functions and services offered by SOCs, along with some of the challenges faced by a SOC