Prepare & Inform

The SOC plays an important role in keeping the rest of the organisation up to date about the latest innovations in security, what is currently trending in cybercrime and any upcoming new threats that are being developed. 

Preventative Maintenance

A SOC is responsible for maintaining a business's defenses. This includes ensuring that existing systems and firewall policies are regularly updated; any identified vulnerabilities are patched;  securing applications that may include white and black listing. 

Proactive Monitoring

Monitoring networks on a 24/7 basis through the use of SIEM tools allows the SOC to be notified immediately of threats that are emerging, giving them the highest chance to prevent or mitigate any negative repercussions. 

Managing & Ranking Alerts

Once an alert is identified by a monitoring tool, a SOC eliminates any false positives and determines how severe any confirmed cyber threats are and what they are targeting. 

Incident Response

Immediately after a security incident occurs the SOC is responsible for actions such as terminating or isolating endpoints, stopping any processes that may be harmful, deleting files, and more. 

Incident Recovery & Investigation

Post an incident the SOC is responsible for restoring systems and salvaging any data that was lost or compromised during the incident. Once recovery has been achieved, the SOC will also be responsible for investigating exactly what happened when, how and why.

Log Management

The SOC is responsible for collecting, maintaining, and regularly reviewing the log of all network activity and communications. By doing this the SOC can define what is considered as “normal” network activity. By identifying a baseline, the SOC can have an easier time revealing the existence of future threats.

Compliance Management

The SOC is responsible for compliance with such regulations, which may be issued by their organisation, by their industry, or by governing bodies, e.g. ISO 27001, PCI DSS or the UK GDPR. To ensure this the SOC needs to regularly audit an organisation's systems.