Today's security operations center (SOC) is drowning in alerts. Billions of them — alerts that obscure legitimate threats and burn out cybersecurity teams with tedious manual labor. Analysts are trying to reduce or refine the volume of events, but SOCs have yet to reduce events in a meaningful way.
But that's about to change. Automation and emerging technologies are enhancing and changing the organizational structure of the SOC. This is all ultimately for the better — but it means that roles will change as well; Level 1 and Level 2 analyst jobs as we currently know them are going away. Let's take a look at what a new SOC paradigm could mean for your organization.
The New SOC Means New Roles A recent Ponemon report, "Economics of Security Operations Centers: What Is the True Cost for Effective Results?," found that one of the most significant problems with running an in-house SOC stemmed from staff burnout and turnover. Seventy percent of respondents agreed that their SOC analysts burn out quickly because of the high-pressure environment and workload. Respondents listed the main stressors as information overload and being forced to chase too many alerts.
The old SOC model is a constant battle of humans vs. alerts, and it isn't working. In the new SOC, a new paradigm changes the game. It requires an automated approach. Take the Level 1 SOC analyst, for a start. It's an operational entry-level role, focusing on real-time security event monitoring and security incident investigation, continuously monitoring customers' infrastructure to identify security incide ..
Support the originator by clicking the read the rest link below.
