8

the other day I was talking with a service provider (MSSP) who have experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't understand why it would be so steep. My impression of a SOC is :

a) getting a log collector such as HP arcsight
b) implement IDS on different locations, eg snort which is low cost.
c) forward the logs from these IDS (and other devices) to Arcsight
d) Let ARcsight do the magic of correlating events.
e) 2-3 Analysts on the Arcsight console monitoring 24x7 (on shifts) and 
   doing incident response. this I could probably do in-sourcing as I don't 
   have the staff to do this.the console could use vmware or some other 
   virtual technology, thus I save on the hardware cost?

With the above, I don't think my SOC would cost in the millions. Or is setting up an SOC really not that simple?

Disadvantage I can think of when using MSSP:

a) Lack of resource to monitor full time as MSSP may use shared resources for different clients
b) Slow response to incident?
c) Could not customize the way I want to run the show

What are your thoughts of engaging MSSP? What other things do I need to consider if I wish to set up my own low cost SOC?

thank you

  • Your list of activities for a SOC isn't really a SOC: you've only described log analysis. Have you read something like this: defcon.org/images/defcon-18/dc-18-presentations/Pyorre/… – schroeder Feb 5 '15 at 18:17
  • hi schroeder, yes I have gone through the slides you refered. Even seen the video presentation on youtube. And the title is "for little or no money". The IDS are low cost if we use snort. the events, reporting, correlation can be done using things like Arcsight, which is expensive but won't be in the millions. The rest is to engage staff for incident reponse, analysis on 24x7. I think such a setup should not be that exorbitant. – dorothy Feb 6 '15 at 1:38
  • Incident response, in my opinion as a SOC architect, is where the cost resides. If all you are looking for is 24x7 log analysts who send alerts when anomalies are found, then yes, you can do that for lower cost, but once you need experts handling Incidents 24x7, then your costs skyrocket. Add in the 3rd party's certification (SOC, ISO, FEDRAMP, etc.) and "millions" is not out of the question. – schroeder Feb 6 '15 at 1:52
3

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight.

Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that depending on the size and bandwidth of your network can cost from $100K to $3M.

But once it is up and running, now part of the SOC daily routine is to look into the alerts and tune the tool to avoid too many false positives; it involves revising the rules and use cases. For the first six months, if you do not have the right resources, you may only see red dashboard full of alerts that you don't know which one to pay attention to.

When an incident happens, a world-class SOC has a well defined triage, investigation, and escalation process to handle it, with at least 2 tiers of analysts. A 24x7 SOC should respond in near real time, and take appropriate actions against the attacks that was detected.

Usually, these tiers are security experts, which are expensive, and rotating in shifts make it even more expensive. The service must be reliable, which requires lots of redundancy. They also should do the threat intelligence gathering and research on the new trends in cyber attacks for you. These are expertise that are rare and expensive.

But just $1M per year for SOC is not reasonable. If you go to big players, because they use the economy of scale, they may offer a better deal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.