{"id":4066,"date":"2022-08-31T10:25:51","date_gmt":"2022-08-31T14:25:51","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=4066"},"modified":"2022-08-31T10:28:39","modified_gmt":"2022-08-31T14:28:39","slug":"how-to-build-a-security-operations-center-soc-on-a-budget","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/","title":{"rendered":"How to Build a Security Operations Center (SOC) on a Budget"},"content":{"rendered":"

\"SOC<\/p>\n

As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 Matthew Warner of Blumira<\/a> takes you through the ins and outs of security operations centers, and how to build one on a budget.<\/strong><\/em><\/p>\n

\"SRA security operations center (SOC) is expensive.<\/p>\n

From the technology utilized to the personnel needed to run it, a traditional SOC can cost an organization millions of dollars per year. For small and medium-sized businesses, this price tag alone serves as a major deterrent. Instead of trying to build and operate a SOC beyond their means, small and medium-sized businesses should recreate the capabilities a SOC provides through other methods. After all, these companies should still be able to protect their environments like larger enterprises.<\/p>\n


Widget not in any sidebars
<\/span><\/p>\n

SOC: The Ins and Outs for a Budget-Conscious Mind<\/strong><\/h2>\n
\n

What is a SOC?<\/strong><\/h3>\n

Many people imagine a SOC as a physical place. While this is true to a point\u2013the images of a large, windowless room filled with flat screen monitors and security analysts sitting at desks\u2013a SOC is also seen as an organizational framework for security. It combines many components of a robust security environment, including people, processes, and tools that can detect, respond to, and analyze security threats. Traditional SOCs run 24 hours a day, seven days a week, with security analysts interacting with environmental data to watch for emerging threats and respond as required.<\/p>\n

SOCs typically leverage different security technologies, including:<\/p>\n

    \n
  • SIEM (Security Information and Event Management):<\/strong> This is a centralized logging platform that takes data from various alert systems and combines it into a cohesive view.<\/li>\n
  • EDR (Endpoint Detection and Response):<\/strong> This is a type of software that runs on endpoints to detect incoming threats. It provides real-time monitoring with an automated response that helps mitigate known issues.<\/li>\n<\/ul>\n

    Who Works in a SOC?<\/strong><\/h3>\n

    A SOC is about people as much as it is about technology, since SOCs involve multiple employees working at different levels of responsibility based on their experience. Let\u2019s look at some of the key roles:<\/p>\n

      \n
    • Tier 1 (Triage):<\/strong> An entry-level position who works on the front lines of the SOC. Their job is to respond to the hundreds of daily alerts that get sent, along with providing end-user support when needed. This job is tedious and monotonous and leads to high burnout, so employers may find themselves frequently filling and refilling these positions.<\/li>\n
    • Tier 2 (Security Investigator):<\/strong> A more experienced team member, this role takes a higher view and attempts to locate the sources of an attack and create mitigation strategies.<\/li>\n
    • Tier 3 (Advanced Security Analyst):<\/strong> Another step above, this person looks at the SOC\u2019s operation and looks for security trends. This role also involves planning and incident response.<\/li>\n
    • SOC Manager: <\/strong>Outside of the tier system, this person manages SOC operations and communications with technology leadership, such as the chief information security officer and chief technology officer.<\/li>\n<\/ul>\n

      What Challenges Exist in Building a SOC?<\/strong><\/h3>\n

      Building a SOC requires the right technology and the right people. Both can be difficult to find and acquire\u2013especially personnel. Organizations find themselves fighting over a limited talent pool, requiring consistent recruiting and hiring in order to keep a SOC properly staffed. With high competition, professionals will more easily move from job to job in search of better offers. There is currently a skills gap in the cybersecurity marketplace, meaning there are simply not enough professionals to fill job openings. Hiring outside staffing firms can help cut time from this process, but often the cost is prohibitive for small businesses. For many organizations, the talent battle makes it difficult to fill even entry-level jobs.<\/p>\n

      Along with hiring, there is also the challenge of technology. While different security solutions provide a range of essential capabilities, the excess technology in a SOC can become overwhelming, as vendors continually create new products to address emerging issues. This continued growth, though, leads to a complex lattice of solutions that provide too much coverage in some areas and not enough in others. This results in a phenomenon known as \u201calert fatigue,\u201d where team members become numb to the constant barrage of security threats. False alarms account for about 40 percent of all alerts and further encourage the habit of ignoring these warnings, especially during busy times. This ultimately leads to employee burnout and decreased performance.<\/p>\n

      The Cost of a SOC<\/strong><\/h3>\n

      While technology certainly has a high price tag, the costs for a SOC primarily come from the analysts. For a traditional SOC, organizations should expect to hire a minimum of five security analysts to cover all shifts. Even organizations that hire predominantly junior team members should budget a minimum of $500,000 each year. Some organizations choose to hire experienced engineers and build automated alerting tools, but even that scenario requires paying a team member $150,000 or more. According to Ponemon, the average organization spends $2.86 million annually to run an in-house SOC.<\/p>\n

      Building SOC on a Budget<\/strong><\/h3>\n

      The ultimate goal of a SOC is to provide visibility into your environment and detect and respond to threats. For many organizations, the benefits of a traditional SOC do not equal the financial commitment needed. While a SOC is excellent for a large enterprise that can afford it, many smaller organizations will want to find workarounds that offer similar functionality without the cost. The best approach is to start slowly, collecting data logs from sources in your environment that can later feed automated technology. A SIEM solution can take this log data and provide visibility into your infrastructure. Centralized logging provides visibility into the environment, but analyzing log files from multiple sources can be overly time-consuming. A SIEM can provide analytics, search, and reporting capabilities to provide context around these events and alert to suspicious behavior. Many SIEMs charge per log, although there are some that simply cost a flat fee per user. Look for a solution that fits within your budget.<\/p>\n

      Much of the work in a SOC revolves around checking alerts\u2013many of which are false positives or do not require attention. With the right SIEM, users can better manage alerts and ensure that they only receive actionable items. Accompany alerts with context or built-in workflows and playbooks that give suggestions for the next steps. Using a SIEM solution, you can quickly respond to critical threats, respond within the next day to high-priority threats, and delay lower threats to when time allows. Leveraging a SIEM-oriented process, along with data logs, can create many of the same functionalities of a SOC without the high cost. A SOC is not the right choice for everyone, but the capabilities and a secure network are something everyone can afford with the right approach.<\/p>\n


      Widget not in any sidebars
      <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

      As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 Matthew Warner of Blumira takes you through the ins and outs of security operations centers, and how to build one on a budget. A security operations center (SOC) is expensive. From the technology utilized to […]<\/p>\n","protected":false},"author":295,"featured_media":4067,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[1726,1915,95,403,1785,1414,86,1656,172,22,282],"acf":[],"yoast_head":"\nHow to Build a Security Operations Center (SOC) on a Budget<\/title>\n<meta name=\"description\" content=\"Matthew Warner of Blumira takes you through the ins and outs of security operations centers (SOC), and how to build one on a budget.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Build a Security Operations Center (SOC) on a Budget\" \/>\n<meta property=\"og:description\" content=\"Matthew Warner of Blumira takes you through the ins and outs of security operations centers (SOC), and how to build one on a budget.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-31T14:25:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-31T14:28:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/08\/How-to-Build-a-Security-Operations-Center-on-a-Budget.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Matthew Warner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Matthew Warner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/\",\"name\":\"How to Build a Security Operations Center (SOC) on a Budget\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/08\/How-to-Build-a-Security-Operations-Center-on-a-Budget.jpg\",\"datePublished\":\"2022-08-31T14:25:51+00:00\",\"dateModified\":\"2022-08-31T14:28:39+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/f1d925af2eba4abd0ae304bc6af8b8e6\"},\"description\":\"Matthew Warner of Blumira takes you through the ins and outs of security operations centers (SOC), and how to build one on a budget.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/08\/How-to-Build-a-Security-Operations-Center-on-a-Budget.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/08\/How-to-Build-a-Security-Operations-Center-on-a-Budget.jpg\",\"width\":800,\"height\":400,\"caption\":\"SOC on a budget\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Build a Security Operations Center (SOC) on a Budget\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/f1d925af2eba4abd0ae304bc6af8b8e6\",\"name\":\"Matthew Warner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7b943d1b7da851f7847b10be731fa1ce?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7b943d1b7da851f7847b10be731fa1ce?s=96&d=mm&r=g\",\"caption\":\"Matthew Warner\"},\"description\":\"Matthew Warner is CTO and Co-Founder of Blumira, a leading cybersecurity provider of automated threat detection and response technology. At Blumira, he leads the security and engineering efforts to provide actionable insights into cybersecurity risks at scale. Matt has over 10 years of experience in IT and development, focusing on business strategy, development, compliance, threat detection and penetration testing. Previously, he was Director of Security Services, Development & Security at NetWorks Group, responsible for defensive information security and services.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/mwarner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Build a Security Operations Center (SOC) on a Budget","description":"Matthew Warner of Blumira takes you through the ins and outs of security operations centers (SOC), and how to build one on a budget.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/","og_locale":"en_US","og_type":"article","og_title":"How to Build a Security Operations Center (SOC) on a Budget","og_description":"Matthew Warner of Blumira takes you through the ins and outs of security operations centers (SOC), and how to build one on a budget.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2022-08-31T14:25:51+00:00","article_modified_time":"2022-08-31T14:28:39+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/08\/How-to-Build-a-Security-Operations-Center-on-a-Budget.jpg","type":"image\/jpeg"}],"author":"Matthew Warner","twitter_misc":{"Written by":"Matthew Warner","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/","name":"How to Build a Security Operations Center (SOC) on a Budget","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/08\/How-to-Build-a-Security-Operations-Center-on-a-Budget.jpg","datePublished":"2022-08-31T14:25:51+00:00","dateModified":"2022-08-31T14:28:39+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/f1d925af2eba4abd0ae304bc6af8b8e6"},"description":"Matthew Warner of Blumira takes you through the ins and outs of security operations centers (SOC), and how to build one on a budget.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/08\/How-to-Build-a-Security-Operations-Center-on-a-Budget.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/08\/How-to-Build-a-Security-Operations-Center-on-a-Budget.jpg","width":800,"height":400,"caption":"SOC on a budget"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-build-a-security-operations-center-soc-on-a-budget\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"How to Build a Security Operations Center (SOC) on a Budget"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/f1d925af2eba4abd0ae304bc6af8b8e6","name":"Matthew Warner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/7b943d1b7da851f7847b10be731fa1ce?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7b943d1b7da851f7847b10be731fa1ce?s=96&d=mm&r=g","caption":"Matthew Warner"},"description":"Matthew Warner is CTO and Co-Founder of Blumira, a leading cybersecurity provider of automated threat detection and response technology. At Blumira, he leads the security and engineering efforts to provide actionable insights into cybersecurity risks at scale. Matt has over 10 years of experience in IT and development, focusing on business strategy, development, compliance, threat detection and penetration testing. Previously, he was Director of Security Services, Development & Security at NetWorks Group, responsible for defensive information security and services.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/mwarner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4066"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/295"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=4066"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4066\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/4067"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=4066"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=4066"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=4066"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}