Comparative Analysis of Security Operations Centre Architectures; Proposals and Architectural Considerations for Frameworks and Operating Models

Abstract

Few initiatives tried to define an architectural framework for an Information Security Operations Centre (SOC) at this point. As it is a topic that encompasses the three dimensions of technology, processes and people, the documentation and resources available are usually treating only one or two of these three dimensions. This article tries to treat the Security Operations Centre in the complexity that it demands, looking at all the stated three dimensions and trying to propose a few architectural considerations regarding frameworks and operating models that can be used when building a variably sized SOC, with its applicability throughout organisations in different fields of interest.