NCSC Shares Alternatives to Using a SOC

A leading UK security agency has identified several approaches that can reduce or eliminate an organization’s need to run a time- and resource-consuming Security Operations Center (SOC).

The SOC is an increasingly important function for security operations (SecOps) teams tasked with detecting, hunting, and responding to cyber threats.

But that could require an ongoing investment of significant time and resources, the National Cyber ​​Security Center (NCSC) acknowledged in a new blog.

Read more about SOC: How to build an Autonomic Security Operations Center (SOC)

Senior Security Architect David S explained that some organizations may not need a SOC at all. He shared the following approaches used by governments to reduce that need.

• A 100% cloud-native/serverless architecture benefits from tightly integrated identity management controls that limit the types of possible attacks.
• Zero-touch production (services where engineers do not have direct access to production services) can reduce system risk and the need for security monitoring. If direct access is required, it can be provided on a time-limited basis.
• Separate cloud accounts for separating functions and strict access controls also reduce risk.
• Cloud-native services offer their own logs and services for analyzing and validating integrity. This can replace the need for a dedicated his SIEM.
• You don’t need a security team because secure development practices allow your operations team to take responsibility for security. Service operations teams are more likely to identify suspicious behavior than SOC analysts.
• You can set an alert to warn you if logging stops for any reason.

This is not to say that SOCs do not yet have a place in the modern enterprise, added David S.

“Some enterprise IT systems such as endpoints and traditional IaaS-based architectures still have a requirement to provide reactive monitoring of the system,” he concludes.

“A centralized SOC also has the advantage of allowing government departments to identify broader attacks probing multiple services used by an organization.”