A security operations center is a centralized unit that handles organizational and technical security challenges.
Steps in Building a Security Operation Center
1. Develop your security operations center strategy.
First, you must develop your strategy.
- What risks must you address?
- What is your organization’s security posture?
- Where do you want it to be in three to five years?
- What are your goals?
Next, develop a plan for your security operation center. Then, consider the size and risk of your organization. For example, how large is it, and what kind of threats does it face? Who will run the center, and what knowledge and training will they need?
2. Create a staff.
Once you know how big your operation needs to be, you can begin hiring staff. This step includes deciding how many people will be in the center and the position titles for each person. You will need a director, analysts, and support staff — such as help-desk personnel — among others.
3. Create an operating model.
This step requires defining how much control you want over your security operations center. Also, who within the organization should have access to information gathered by the center.
You can choose from one of three models: decentralized, centralized, or hybrid. The decentralized model also gives employees and managers in different departments their own control over managing their security posture. Besides, this may be appropriate for larger organizations with multiple branches or offices in different countries.
A centralized model gives all control to a single group or individual. This may be appropriate for smaller organizations with only one branch or office — or if there is a security expert on staff who wants to handle all of the security responsibilities.
Besides, a hybrid model offers the best of both worlds: information is shared between different departments within an organization according to specific rules or protocols that must be followed; this may be appropriate for medium-sized organizations that want to share information but still maintain some control over the process.
A good operating model also includes how employees should communicate with each other about issues related to information security, who will report potential risks to the security operations center, and how often updates should be provided by each division within the company.
4. Create your network.
The final step is to create the physical network that will be in use to collect data and transmit information. This will require installing hardware, software, and networking components. It also requires establishing the physical security of the network in order to protect it from threats like fire, flood, or vandalism.
So after you build the security operations center, you must design a maintenance plan for it. This plan should also include regular updates for all of its components to ensure that they are functioning properly and that they are compatible with each other. The plan should also include backup procedures in case of a disaster, as well as procedures for updating personnel on new threats or changes in the law.
