SOC- and SIC-based information security monitoring

Abstract

New numerous and sophisticated attacks make organizations’ IT infrastructure (ITI) break-in more professional and dangerously effective. The organizations must oppose this properly designed and centralized information security (IS) incident management system. Learn from the past helps to avoid the consequences of serious IS incidents in the future. Therefore, IS monitoring is necessary for rapidly detecting IS incidents, minimizing loss and destruction, mitigating the vulnerabilities exploited and restoring organization’s ITI. This process can be implemented based on Security Operations Centers (SOCs) and Security Intelligence Centers (SICs) as their next evolution step. SOCs’ main functions and serious limitations are defined. The SICs’ concept and functioning are analyzed. The main ideas of further research conclude the paper.