Building Your Best Practice Cyber Security Operations Centre (CSOC)

Our Cyber Security Practice Director Chris Cooper talks objectively about in-house expertise vs CSOC managed services and specialist partnerships.

Protecting your organisation from cyber security breaches and incidents is a basic necessity for organisations of all sizes. It’s almost impossible to operate without a digital presence, tools and resources. But the price of connectivity and convenience is increased risk – the risk of ever-changing and growing external threats from criminals, hackers and malware.

To manage this risk for your organisation and fend off threats, you need to ensure you have visibility into incidents and events that may be occurring within your environment, along with a cyber security operations centre (CSOC) to monitor and respond when something is not looking right. Your CSOC (or security operations centre/SOC, as many organisations call it today) should provide 24×7 security monitoring, detection and alerts around your end-to-end infrastructure to give you full security event visibility and incident management.

Monitoring, detection, alerting and reporting all sound like processes that could be carried out by automated software and solutions, including a security information event management (SIEM) platform. It’s true that there’s a lot of excellent cyber security technology available, with a vast capacity to scan for threats and incidents automatically. But as with most digital approaches, even for small and medium enterprises (SMEs) there’s not a one-size-fits-all solution available off the shelf.

Moreover, as well as good technology protection, you need expertise and experience from cyber security professionals to plan, deploy and continually update your CSOC resources, in response to ever-evolving threats. If anything gets through your defences, your team will make the decisions and take the actions that keep your organisation’s data, assets and digital infrastructure safe, enabling business continuity.

How much can you afford to pay – or not to pay – for trusted CSOC resources?

It’s vital work – but paradoxically, the less you see of it, the more successful your CSOC’s activities are. This means it can be easy for budget holders to underestimate the value and impact of a well-resourced and powerful CSOC. No news is good news when it comes to security breaches and incidents, as far as your organisation’s frontline roles and operations are concerned.

Dealing with threats to information security and data can be sensitive work, so it’s understandable that organisations may believe it’s safest to keep the CSOC in-house. But can an in-house operation deliver the rigorous protection and oversight you need for full confidence and risk reduction? Any reassurance in keeping data security in-house will be negated if you don’t have sufficient expert resources on-side to deliver exceptional CSOC services at all times.

Effective CSOCs need talented and experienced staff with the latest best practice knowledge

Outsourcing your CSOC can be a more cost-effective approach than recruiting and retaining a full team in-house, especially for SMEs and lean organisations that don’t want to shoulder onerous staff, training and technology costs directly. Even if you have the budget, with the current global cyber security skills shortage you may not be able to find the people you need.

A leading CSOC specialist will employ cyber security consultants and experts at the top of their game, with the latest information and best practice knowledge that you want in your corner. Because it’s their specialism and because their success depends on their reputation and track record, they’ll make it their business to employ the most skilled and knowledgeable experts and to be at the cutting edge of cyber security technology and best practices.

When you’re weighing up the alternatives of an in-house or outsourced CSOC, it’s a good idea to consider the calibre of service and protection they can offer in key areas of cyber security.

Fully-customised CSOC service

An in-house team will know your organisation best, assuming they’ve been embedded for a while and are familiar with your cultures, practices and technology estate. Though if you’re recruiting externally to form the team, they’ll need induction and time to get to know the organisation and its resources.

An established CSOC outsourcer will have lots of experience getting to grips with a client’s specific needs quickly and thoroughly. They’ll use their extensive experience of different client environments to implement the best monitoring solution for your needs. They’ll also have certified security consultants and engineers to configure and test the solution, and they’ll be responsible for making sure it’s doing exactly what it should in your unique organisational environment.

Proactive triage and alert analysis

24×7 monitoring means automated technology, but it also demands that security professionals are on hand to react rapidly in the event of an incident. AI technologies aren’t yet developed enough to do it all for you. Your team will need the expertise to make connections between separate incidents so they can marshal resources to address issues effectively. Maintaining that level of cover internally can be expensive – but if you don’t resource 24×7, what’s the potential cost of an out of hours incident escalating?

Rapid threat analytics and investigation

Incidents and issues need confident and thorough assessment. CSOC analysts must be knowledgeable and experienced enough to look at a range of incidents, identify possible causes, notice indirect associations to other indicators, and assess the scale of potential breaches. They need to be able to select and deploy the most effective remedial actions, and make it all happen fast, often under pressure. Experience is key: you’ll need talented (and highly paid) senior staff in your internal CSOC to provide it to the same degree as third-party cyber security specialists.

Compliance

Your CSOC and SIEM service should align to your chosen compliance frameworks. If you’re outsourcing, you’ll want to ensure that your partner has the appropriate accreditations to meet your information security standards. In-house team members will need support and resources to maintain their personal certifications.

Comprehensive reporting

Reactive cyber security monitoring and issue detection alone is a firefighting service. To build your resilience, you’ll want to see regular and informative reporting that highlights trends and common issues, to help you track and strengthen security performance. You may need analytics skills in your CSOC to deliver actionable reporting, or to invest in a dashboard application. A managed CSOC should provide this as part of the service.

Building your best practice CSOC

For a leading edge CSOC that provides maximum insight and protection, managed services can be an excellent and cost-effective solution, particularly for SMEs. The key is finding a proven and trusted partner.

You’ll want to be sure that your chosen partner’s approach and values match yours – you’re entrusting them with vital data and sensitive information and relying on them to protect it from a sophisticated world of threats and dangers. Look for experience and expertise in CSOC service provision as well as an understanding of your business and sector and a willingness to listen, so they can tailor best practices to fit the precise needs of your organisation.

Six Degrees’ government accredited Managed CSOC/SIEM Service offers security monitoring, detection and alerts around your infrastructure and technical solutions for full security event visibility and incident management. Experienced CSOC analysts identify potential cyber security breaches and incidents 24×7, and actively work to isolate and contain threats to your organisation. Get in touch if you’d like to find out how we can support you.

About the Author

Chris Cooper is Cyber Security Practice Director at Six Degrees. At Six Degrees, we’ve been helping organisations confront cyber security challenges for over 15 years. While cyber threats are always developing, our experience and industry presence are testament to our ability to stay ahead of emerging threats.