Introduction to Security Operation Center

 What is SOC / CSOC?

   Some companies called it CSOC but most people have known it as SOC. This SOC word abbreviates as  Security Operation Center or when about CSOC it abbreviates as Cyber Security Operation Center.   

                                                 Figure 1 - Security operation Center     

 Why is SOC / CSOC?

Everybody has a question why this type of center is maintained by the companies. The answer is to monitor all the incoming and outgoing data traffics, employees' activities, the behavior of the information systems and network to see whether are there any kind of vulnerabilities or suspicious activities are there. If there is something fishy, cyber security analysts need to report them to the liable authorities. 

To find these vulnerabilities and other kinds of things employees of the security operation center need to follow different types of techniques, tools, and procedures. Among the techniques, some of them are threat hunting, penetration testing, and vulnerability assessment. Nmap, Maltego, Wireshark, Burpsuite, Metasploitable framework can be named as the often use tools.     

 What are the different approaches?

There are different approaches are available in the Security Operational Center. They are centralized, distributed, in-house, constituency, managed, and hybrid. For all of these, there are different kinds of backgrounds are available.    

• Centralized  - here there is one team and one central location which is close to HQ. This is the most common approach for the SOC and it will be available 24 x 7 and this is the most feasible way to conduct SOC.                                                            

• Distributed - there are multiple teams are available to conduct SOC operations in different locations. But their goal is common and it can be available 24 x 7 or 8-hour shits that follow the sun.   

• In-house - in this approach, staff are the insiders and they are dedicated to the different tasks. They know the company environment better than anyone because they have access to all the systems.          

• Constituency - here all the things are handled by the external SOC experts. Within that, there are two types as managed and unmanaged. Managed means the write access is available for the devices and unmanaged means no write access is available for the devices.

• Managed - in this approach, we can see active access on security appliances and a quick start with less apex. But here employees have less environmental knowledge about the scenario.      

• Hybrid - this approach has the set of qualities that we can find in the other approaches and because of that, this is a hybrid version. Here we can see that centralized control and the quickest detection response time.         

                                                

What are the techniques and procedures in SOC?

Within the SOC there are different kinds of techniques procedures use to achieve the goal. And all the things are handled according to that. 

      Scanning - network scanning

                      vulnerability scanning
                      port scanning

        Monitoring - 24 x 7 monitoring
                             real-time monitoring     
                             network monitoring

        Response - automated

                          manual

                          active

                          passive

                          deter

                          block

                          onsite

                          remote  

With all these SOC teams responsible for monitoring, detecting, containing, and remediating IT threats across applications, devices, systems, networks, and locations.