Security operations center
The team that watches an organization's systems around the clock for attacks.
A security operations center, or SOC, is the team (and often the room) in charge of watching an organization's systems for attacks and reacting when one happens. Think of it as the security guards of the digital side: they monitor alerts day and night, decide which ones are real, and contain the damage when something gets through.
The day-to-day work is a loop. Tools such as a SIEM and endpoint protection on every laptop send alerts. Tier 1 analysts triage them: most are false alarms, some are a user who clicked a phishing link. Real cases go to more experienced analysts who investigate, isolate an infected computer, reset stolen passwords or block an attacker's address. Afterwards the team writes down what happened and adjusts its rules so the same trick is caught earlier next time. Some SOCs also do threat hunting: actively looking for intruders no alert has spotted.
Running a SOC 24/7 takes several shifts of skilled people, which is expensive. That is why many mid-size companies hire one as a service from a specialized provider (often called MDR, managed detection and response) instead of building their own. Whatever the setup, the point is the same: attacks happen at night and on holidays too, and the sooner someone notices, the smaller the damage.
Keep in mind
- A SOC monitors, detects, responds to and learns from security incidents.
- Analysts are organized in tiers: triage first, deep investigation after.
- Its main tools are a SIEM, endpoint protection and well-rehearsed playbooks.
- Many organizations rent a SOC as a managed service instead of staffing one.
