Based on Gartner’s The Five Models of SOC
A security operations center (SOC) provides centralized and consolidated cybersecurity incident prevention, detection, and response capabilities. Companies of all sizes can build and maintain a SOC in one of the following models. You can’t do security without a SOC.
Mid-market companies have the same security needs as large enterprises without the luxury of large teams and budgets. A SOC is not just a luxury but a necessity in today’s threat landscape. Gartner outlines five models of a SOC. However, SOC-as-a-Service is a best choice for mid-market companies. This turnkey solution combines the people, process, and technology for comprehensive security, including threat detection and response. With SOC-as-a-Service, you don’t need a security team, infrastructure, or dedicated facility.
Virtual SOC
This SOC does not reside in a dedicated facility, nor does it have a dedicated infrastructure. It is built on decentralized security technologies with a virtual team who become active in cases of incidents, making it best suited for SMBs. It is mostly reactive and can be improved through automation, SIEM, and analytics.
Multifunction SOC/NOC
This SOC model has a dedicated team, facility, and infrastructure that does more than security, including IT operations, compliance, and risk management. It is best suited for SMBs or mid-sized companies with low-risk exposures. It puts less emphasis on security, but makes use of shared resources, infrastructure, and facility.
Co-managed SOC
A typical co-managed SOC is delivered by MSSP vendors for mid-sized to large companies whose core expertise is not IT or security operations. It is typically an 8x5 operation with 24x7 monitoring. Key drivers for this model of SOC are resource constraints and budget limits. The trade-offs are control and customization. It offers great benefits and can deliver good results when deployed and managed well.
Dedicated SOC
A Dedicated SOC is a centralized SOC that has a dedicated infrastructure, team, and processes. It is self-sustained for continuous operations. It has 5-8 security experts at various levels for 24x7 monitoring and operations. It is best suited for large enterprises and government agencies who are constantly at risk of attacks. This model of SOC is essential for global companies with private data in various locations that must comply with regulations and security policies.
Command SOC
Global 2000 companies, large telecom providers, and defense organizations use this model of SOC because it has multiple SOCs distributed globally or in various locations. A command SOC typically controls other SOCs and is more focused on managing threat intelligence and situation awareness than day-to-day operations. It is also used for forensics and other recovery processes. The Command SOC is managed by a large team of security experts and a security research team with hunting capabilities.
The Best Choice
SOC-as-a-Service is an outsourced model that extendes the capablities of a company’s IT team and provies end-to-end security, It includes a managed detection and response (MDR) service, which removes the burden of determining the best methodology or technology for threat detection and response. The Arctic Wolf SOC-as-a-service leads the industry in making security simple, actionable, and affordable. Arctic Wolf is anchored by a Concierge Security™ Team who uses the Arctic Wolf platform to provide tactical and strategic insights into your security to answer the question, “Am I safe?”
Despite significant investments in network and application security, many companies continue to experience costly and damaging security breaches. A SOC-as-a-service managed security model augments current network security tools with continuous threat monitoring, detection, and response.
This is based on Gartner’s paper titled “Five models of Security Operations Center”. For more information or to download the whitepaper, go to Gartner’s website by clicking here.
