I have received this question from a few clients, but I have 0 experience building a 24x7 SOC.
asked Nov 16, 2010 at 5:04
-
This depends immensely on size of the organization, complexity and number of systems, usage patterns, level of required/actual security, etc. Can you add some more details?– AviD ♦Nov 16, 2010 at 6:00
-
my.safaribooksonline.com/networking/security/9780071713405/…– atdreNov 16, 2010 at 14:49
-
2I ‘ve gotten this question a few times from organizations with one or two security engineers. It is usually sparked by a series of security incidents that pushes them to want to move to 24x7 coverage. The goal of this question is to answer the number of people (with defined roles) and budget to squeeze out a running 24x7 SOC. The # of systems, complexity, and other details is hidden – of course this implies the client is able to prioritize his skeleton SOC to monitor what’s most important.– Tate HansenNov 16, 2010 at 17:46
-
One important aspect of that question is where you want your SOC to be established, because at the end this mainly comes to how much people you need to run it, and people cost varies greatly on where you are. The where question is not just a money matter of course, many other things are involved like legal aspects, risk management, quality etc.– ack__Feb 21, 2014 at 11:36
-
mitre.org/publications/all/…– atdreJan 9, 2015 at 21:00
Add a comment
|
1 Answer
As the others mentioned this can only be established when you know more requirements.
These might include but not be limited to:
- Region
- 24x7?
- scale/type of work involved. (I.e. how much work/ how often ?)
For a rough idea you could sketch out how the current incidents you mentioned would've been ideally dealt with, and how much work this would've taken from how many people - with generous estimates as always on time actually required.
