Security operations center
A security operations center (SOC) is responsible for protecting an organization against threats. This can be an information security operations center that defends against cyberattacks, or a security operations center more generally, such as a division of a government security agency.
Information technology
[edit]An information security operations center (ISOC) is a dedicated site where enterprise information systems (web sites, applications, databases, data centers and servers, networks, desktops and other endpoints) are monitored, assessed, and defended. SOC analysts monitor an organization’s network and investigate any potential security incidents. If a cyberattack is detected, the SOC analysts are responsible for taking any steps necessary to remediate it. A SOC includes people, processes, and technology, with a governance and compliance framework.[1] A SOC may be in a building or facility in a central location from which staff supervises the site using data processing technology.[2] Typically, a SOC is equipped for access monitoring and control of lighting, alarms, and vehicle barriers.[3] A SOC can be either internal or external. In the latter case, the organization outsources the security services, such as monitoring, detection and analysis, from a Managed Security Service Provider (MSSP). This is typical for small organizations which don't have the resources to hire, train, and technically equip cybersecurity analysts.
Government
[edit]United States
[edit]National Security Agency
[edit]
The National Security Operations Center (NSOC) or Directorate K is the part of the United States National Security Agency responsible for current operations and time-sensitive signals intelligence (SIGINT) reporting for the United States SIGINT System (USSS).[4] It is one of two centers watching; the other being Directorate V or the NTOC which assesses threats.
Transportation Security Administration
[edit]The Transportation Security Administration in the United States has implemented security operations centers for most airports that have federalized security. Its main operations center is the Freedom Center, formerly known as the Transportation Security Operations Center.
The primary function of TSA security operations centers is to act as a communication hub for security personnel, law enforcement, airport personnel and various other agencies involved in the daily operations of airports. SOCs are staffed 24-hours a day by SOC watch officers. Security operations center watch officers are trained in all aspects of airport and aviation security and are often required to work abnormal shifts. SOC watch officers also ensure that TSA personnel follow proper protocol in dealing with airport security operations. The SOC is usually the first to be notified of incidents at airports such as the discovery of prohibited items/contraband, weapons, explosives, hazardous materials as well as incidents regarding flight delays, unruly passengers, injuries, damaged equipment and various other types of potential security threats. The SOC in turn relays all information pertaining to these incidents to TSA federal security directors, law enforcement and TSA headquarters.
See also
[edit]References
[edit]- ↑ Vielberth, Manfred; Böhm, Fabian; Fichtinger, Ines; Pernul, Günther (2020). "Security Operations Center: A Systematic Study and Open Challenges". IEEE Access. 8: 227756–227779. doi:10.1109/ACCESS.2020.3045514. ISSN 2169-3536.
- ↑ de Leon, Sixto O. (1976). Security: Defense Against Crime. Manila: National Book Store. p. 17.
- ↑ .Nadel, Barbara A. (2004). Building Security: Handbook for Architectural Planning and Design. McGraw-Hill. p. 2.20. ISBN 978-0-07-141171-4.
- ↑ Cryptologic Spectrum: "The National SIGINT Operations Center", Summer 1979 - Vol. 9, No. 3 Archived May 27, 2010, at the Wayback Machine