Modeling a Security Operations Center

Abstract: Security breaches caused by hackers are a significant issue for businesses. This illustrates the need for protection against these attacks. Using a Security Operations Center (SOC) solution to detect attacks against ones corporation is an essential step in doing that. How should businesses deploy their SOC? This thesis compares traditional and modern SOC both by means of a literature study and hands-on experimentation, to evaluate which approach is appropriate for the current situation. The SOC solutions were set up to monitor a simulated office environment, using only free, open-source software. This thesis sheds light on both subtle and significant differences betweenthe two solutions. This thesis also concludes that the time for establishing a traditional SOC has passed. The advantages of utilizing a virtual SOC and its accompanying tool sare too significant to ignore.