The other day I was talking with a service provider (MSSP) who has experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't understand why it would be so steep. My impression of a SOC is:
- getting a log collector such as HP ArcSight
- implement IDS on different locations, eg snort, which is low cost.
- forward the logs from these IDS (and other devices) to Arcsight
- Let ARcsight do the magic of correlating events.
- 2-3 Analysts on the Arcsight console monitoring 24x7 (on shifts) and doing incident response. This I could probably do in-sourcing as I don't have the staff to do this. The console could use VMware or some other virtual technology, thus I save on the hardware cost?
With the above, I don't think my SOC would cost in the millions. Or is setting up a SOC really not that simple?
Disadvantages I can think of when using MSSP:
- Lack of resources to monitor full time as MSSP may use shared resources for different clients
- Slow response to incidents?
- Could not customize the way I want to run the show
What are your thoughts of engaging MSSP? What other things do I need to consider if I wish to set up my own low cost SOC?