Gartner发布安全运营中心（SOC）模型指南
需积分: 5 5 浏览量
2023-11-16
15:29:35
上传
评论
收藏 253KB PDF 举报
Gartner, Inc. | G00787022
Page 1 of 12
SOC Model Guide
Published 18 October 2023 - ID G00787022 - 11 min read
By Analyst(s): Eric Ahlm, Mitchell Schneider, Pete Shoard
Initiatives: Security Operations; Build and Optimize Cybersecurity Programs; Meet Daily
Cybersecurity Needs
Choosing the right security operations center model for an
organization is not just a matter of hiring a team or a service
provider. Security and risk management leaders must carefully
consider operational responsibility and understand the risks,
before probably choosing a form of hybrid model.
Overview
Key Findings
Recommendations
When designing a SOC, security and risk management (SRM) leaders should:
Scaling up a security operations center (SOC) with only internal staff is difficult, if
not impossible, for most organizations.
■
Some SOC tasks are strategic, such as those performed by the roles of senior
investigator, incident response manager and red team tester. They are often best
performed by in-house staff who understand the business’s needs and the security
issues.
■
Other SOC tasks are tactical, such as building detection content for common
attacks. They are generally best performed by a larger external team, which can do
them more efficiently, on a bigger scale, and for longer periods.
■
Organizations working with security service providers commonly assume their
provider is fulfilling objectives that are neither contracted for nor part of its
responsibility.
■
Use their threat detection needs as requirements when building a SOC model.
■
This research note is restricted to the personal use of chenlizhen@qianxin.com.
剩余11页未读，继续阅读
资源评论
