3

I have received this question from a few clients, but I have 0 experience building a 24x7 SOC.

Scott Pack
  • 15,167
  • 5
  • 61
  • 91
Tate Hansen
  • 13,714
  • 3
  • 40
  • 83
  • This depends immensely on size of the organization, complexity and number of systems, usage patterns, level of required/actual security, etc. Can you add some more details? – AviD Nov 16 '10 at 06:00
  • 2
    I ‘ve gotten this question a few times from organizations with one or two security engineers. It is usually sparked by a series of security incidents that pushes them to want to move to 24x7 coverage. The goal of this question is to answer the number of people (with defined roles) and budget to squeeze out a running 24x7 SOC. The # of systems, complexity, and other details is hidden – of course this implies the client is able to prioritize his skeleton SOC to monitor what’s most important. – Tate Hansen Nov 16 '10 at 17:46
  • http://my.safaribooksonline.com/networking/security/9780071713405/measuring-security-operations/ch07lev1sec1 – atdre Nov 16 '10 at 14:49
  • One important aspect of that question is _where_ you want your SOC to be established, because at the end this mainly comes to how much people you need to run it, and people cost varies greatly on where you are. The _where_ question is not just a money matter of course, many other things are involved like legal aspects, risk management, quality etc. – ack__ Feb 21 '14 at 11:36
  • http://www.mitre.org/publications/all/ten-strategies-of-a-world-class-cybersecurity-operations-center – atdre Jan 09 '15 at 21:00

1 Answers1

1

As the others mentioned this can only be established when you know more requirements.

These might include but not be limited to:

  • Region
  • 24x7?
  • scale/type of work involved. (I.e. how much work/ how often ?)

For a rough idea you could sketch out how the current incidents you mentioned would've been ideally dealt with, and how much work this would've taken from how many people - with generous estimates as always on time actually required.

pacifist
  • 794
  • 3
  • 8