The question regularly arises as to how to evaluate the ROI of a SOC. Defining the ROI of a SOC is a little bit more difficult more complex than evaluating the ROI of an antivirus solution.
A SOC is surely a cost center but it’s actually a loss prevention!
In this context, we need to look at it from a different perspective.
SIEM helps analyze identify gaps in your IT security implementation. Combined with aligned processes well-established workflows, automation orchestration (SOAR), it can boost your IT security posture in a number of ways:
- Enhance IT security capabilities
- Refine events with contextual information
- Upgrade reporting risk threat risk assessment
- Correlate numerous types of events across multiple vendors
- Strengthen threat defense response
- Improve threat detection close gaps in existing solutions
From this point of view, you could integrate the gains of your SOC into the ROI calculation of present solutions. Contrary to the previous result, the outcome should be greater than before this share would be the ROI of your SOC.
It’s not so nice! You are absolutely right!
Apply Security Principles
Your organization’s governance must address the question, “How much security is required?” Security principles must assist the organization’s mission , therefore, the notions of efficient security. This involves technology, processes people in regards to costs benefits.
As a SOC manager, you must ask yourself the following questions:
– Is my company spending too much its SOC?
– Is the SOC cost effective?
This involves calculating all the costs of a SOC proving that you can save money by comparing your budget in terms of personnel, process technology with the capacity maturity of your SOC.
Common costs
Environment Infrastructure costs:
- SIEM / data lake platform
- Ticketing system Knowledge base
- Collaboration Communication tools
- Network connectivity infrastructure
- Software licenses
Employee costs for
- Environmental operations
- Analysis Monitoring
- Engineering architecture
Not to mention further costs portfolio management, services, processes personnel.
OK – then what?
From noise to signal
In the absence of events information, it is difficult to maintain a SOC service. In other words, “Without them, your SOC cannot survive.”
So, let’s begin with the event flow. you need to:
– Evaluate the cost of ingested events in your current solution (SIEM/data lake).
– Check the meaning of the event based on your use cases.
– Determine the quality of the event your use case.
– Consider the false positive rate use cases verified by your analyst with the customer.
– Measure the amount of time your Analysts spend on the initial classification of incidents by work order use case.
In the next step, identify areas improvement:
– Find a way to discard unnecessary events your use cases investigations.
– Evaluate the costs of a SIEM versus data lake to retain events threat intelligence hunting (based on your SOC capacity).
– Gauge the reason the false positive ratio of your use cases.
– Appraise the event triage process whether automation is beneficial.
How to build a SOC with limited resources with SECNOLOGY
Building a security operations center (SOC) is a daunting task, faced with the costs of implementation, managers often hesitate. The best way to ensure a profitable investment in the SOC is to work with an easy solution which doesn’t require weeks of training to get hs on, nor skilled or experienced developers to program very advanced scripts very hard to maintain. SECNOLOGY is fitting perfectly with these attributes.
In conclusion
More content needs to be explored, such as IT resources incident management, or off-line storage required backup disaster recovery solutions, business continuity management, systems services instant recovery. But this is beyond the scope of this article. Through this article, SECNOLOGY tries to give you some ideas to get started!
For more information about SECNOLOGY, please visit this link: www.secnology.com
