Glossary term
Security Operations Centre (SOC)
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: SOC
A security operations centre is a team, often with dedicated tools and premises, that monitors an organisation's systems around the clock, detects security events and starts the response.
Explanation
Analysts collect logs and alerts from networks, servers, cloud services and devices into a central tool, usually a security information and event management system (SIEM). They filter the volume of alerts, separate real threats from false alarms, and escalate confirmed incidents to the response team. Many centres are tiered: first-line analysts triage alerts, senior analysts investigate, and specialists hunt for threats not yet flagged. Threat intelligence feeds help them recognise known attacker methods. Firms run a SOC in-house, buy it as a managed service, or mix the two. Quality is judged by measures such as time to detect, time to respond and coverage of critical systems, not by the number of alerts handled. Too many low-value alerts wear analysts down, and a real attack can slip past while they clear the queue.
Example
A mid-sized insurer cannot staff a night shift, so it contracts a managed SOC. At 2 a.m. the provider's analysts see a service account downloading unusually large files. They confirm that this is not routine, disable the account under agreed rules, and phone the insurer's on-call security manager, who starts the incident process before the day staff arrive.
Not to be confused with
- Computer Security Incident Response Team (CSIRT)
- A CSIRT takes charge once an incident is confirmed; the SOC's role is the watching and spotting that comes before.