The advantages of SOC are as follows:
|
SOC |
MSSP |
|
Ability to implement tools that fit your requirements. Full control over staff resources. |
MSSPs provide the tools they provide. Typically, no custom tool selections are available. MSSP resources are typically spread across multiple customers. |
|
Ability to fully customize information security tools. |
Typically limited, no customization is available. |
|
Full control over your organization's log data for analysis and compliance. |
Log data is stored offsite at the vendor facility. |
An important point that an organization must consider when planning out their SOC capability is whether to purchase a full complement of information security tools, or to go down the route of an MSSP.
An MSSP provides an attractive option for a small business, as the MSSP provider runs and operates the information security infrastructure for the organization. Additionally, the MSSP providers provide the monitoring capability of the security analyst, and depending on how much money you want to spend, can completely replace your organization's security operations center capabilities.
The key point to call out here is how much money you want to spend. Replacing the capabilities described in this chapter and the Chapter 8, Incident Response Planning, would result in a very expensive vendor bill indeed.
The first thing you need to do when looking at an MSSP is going back to the business requirements and planning.
Clearly define your requirements by asking yourself questions such as:
- What are you trying to achieve with an MSSP?
- Are you attempting to fully replace an SOC?
- Are you trying to implement a log monitoring capability?
- Can your information security needs be outsourced?
- Information security data is sensitive, can this information be in the possession of a third party?
- What are your monitoring requirements?
- Can your internet service support the bandwidth for external monitoring?