Senior Consultant of the Consulting

[relemedf5w023]

The next logical step in increasing cybersecurity for companies after the implementation and operation of SIEM systems is the stage of building their own center for monitoring and responding to information security incidents (SOC), or turning to external providers of SOC services. The SOC market is approximately twice as young as the SIEM market. Even younger is the market for commercial SOCs providing services for monitoring and responding to information security incidents.

Department of DialogueNauka Ksenia Zasetskaya morocco mobile database that it makes sense for a company to build its own SOC only if the maturity level of its corporate information security is high enough to achieve certainty in the goals and operating mode of the SOC, to ensure documentation of its functioning, interaction of participants in the SOC processes, management of these processes, assessment of efficiency and, finally, analysis of the results and its development. It is often more correct for a company to rely on the competencies of a SOC service provider.

It should be taken into account that information security events are not always incidents. DialogueScience specialists recommend defining criteria for distinguishing incidents from events and prioritizing them based on information security risk assessments linked to the company's actual business processes and aimed at minimizing the consequences of risk realization for core activities.