Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have received this question from a few clients, but I have 0 experience building a 24x7 SOC.

share|improve this question
    
This depends immensely on size of the organization, complexity and number of systems, usage patterns, level of required/actual security, etc. Can you add some more details? –  AviD Nov 16 '10 at 6:00
    
2  
I ‘ve gotten this question a few times from organizations with one or two security engineers. It is usually sparked by a series of security incidents that pushes them to want to move to 24x7 coverage. The goal of this question is to answer the number of people (with defined roles) and budget to squeeze out a running 24x7 SOC. The # of systems, complexity, and other details is hidden – of course this implies the client is able to prioritize his skeleton SOC to monitor what’s most important. –  Tate Hansen Nov 16 '10 at 17:46
    
One important aspect of that question is where you want your SOC to be established, because at the end this mainly comes to how much people you need to run it, and people cost varies greatly on where you are. The where question is not just a money matter of course, many other things are involved like legal aspects, risk management, quality etc. –  ack__ Feb 21 at 11:36

1 Answer 1

As the others mentioned this can only be established when you know more requirements.

These might include but not be limited to:

  • Region
  • 24x7?
  • scale/type of work involved. (I.e. how much work/ how often ?)

For a rough idea you could sketch out how the current incidents you mentioned would've been ideally dealt with, and how much work this would've taken from how many people - with generous estimates as always on time actually required.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.