What is the difference between a SOC and SIEM?

What is the difference between a SOC and SIEM?


As cyber threats continue to grow in sophistication, organisations are exploring ways to further protect their reputation, data and stakeholders from ever-evolving attacks.

Investing in a SOC and SIEM is just one solution that is increasing in popularity. However, there is often some confusion over what the difference is between a SOC and SIEM.

SIEM is the technology used by security experts that provides a real-time view of an organisation’s cyber security position. By collecting, managing and correlating log and event information, SIEM systems detect threats and sends alerts so that analysts can respond to risks effectively.

Typically, you will not have a SOC without a SIEM. A SOC encompasses SIEM technology with a team of analysts and engineers who identify, analyse and respond to cyber security threats, while continually working to prevent attacks.

That’s the difference between a SOC and SIEM in a nutshell, but let’s look at each in more detail...

What is SIEM?

SIEM (Security Information and Event Management) software is a collection of tools that provide the information required to help security teams detect threats and effectively manage security incidents. It combines SIM (security information management) and SEM (security event management) to provide a constant, real-time view of an organisation’s IT infrastructure.

By collecting and analysing log and event data from different sources, SIEM systems are continuously monitoring IT environments in order to detect any unusual activity. Security teams are then alerted to any threats, allowing them to respond and investigate efficiently and with insight.

SIEM limitations

The ability to identify evolving cyber threats makes SIEM a powerful solution for organisations of all sizes. However, deploying a SIEM solution doesn’t mean you are completely protected, as there are some limitations:

Garbage in/garbage out: It may seem that the more data and logs you collect, the better picture you’ll receive from the SIEM. Unfortunately, almost the opposite is true. The adage of GIGO (garbage in/garbage out) applies to SIEM, and many organisations fall into the trap of feeding the SIEM every log and security event - only to find they’re swimming in data and alerts. In these scenarios, SIEM only adds to the noise, rather than cutting through it.

False positives: Since a SIEM can generate thousands of alerts a day, false positives are inevitable. Although they don’t need immediate attention, they must be analysed by an expert to ensure they’re not legitimate ongoing attacks that require attention.

Costly and time consuming: A SIEM solution needs round-the-clock, 24/7 monitoring, regular maintenance and configuration, which creates a mammoth task for any sized organisation. A dedicated, full-time team of experts is therefore required. This, along with the complex and arduous task of managing and maintaining a SIEM can be a huge time and economical expense to an organisation.

To manage your cyber security effectively, an organisation almost always needs more than a SIEM. That’s where a SOC – or Security Operations Centre – comes in.

What is a SOC?

While SIEM is the set of tools used to identify, monitor, record, and analyse security events, a SOC complements this technology with the resource needed to manage it. This includes a team of dedicated security experts that use SIEM tools to continuously monitor an organisation’s IT infrastructure, search for threats and respond quickly to any attacks.

By using a SOC, organisations are providing themselves with an extra form of defence against attacks, regardless of whether they are internal or external, the time of day or the type attack. It also means incidents can be responded to quicker, limiting the amount of damage a cyber attack can have on a business, including reputational, financial and operational.

Build versus Buy

Organisations can invest in their own dedicated SIEM and SOC, operated fully in house with employed full-time staff, but many are choosing to outsource their cyber security by partnering with a Managed Security Service Provider (MSSP).

Managed SOCs can be completely outsourced or the MSSP can work in close partnership with your in-house security staff. By working with an MSSP, organisations can benefit from:

Lower costs: You won’t have to front the capital and operational costs needed to purchase and deploy an in-house SOC or SIEM. The cost of working with an MSSP can also be much more predictable, allowing you to easily forecast costs.

Quicker deployment: Working with already-established technology and experts means you can implement a SOC much quicker than building it in house.

Latest technology: Utilise the latest in technology and processes for optimum monitoring and protection of your digital infrastructure.

Round-the-clock monitoring: You will gain immediate access to security experts with specialist skills required to manage the security of your organisation effectively, 24/7.

Considering outsourcing your cyber security? Here at CCL Group we can work with you to create a managed service tailored to your exact requirements and aligned with the needs of your organisation. With our own on-site SOC, you’ll benefit from the latest technology, accredited processes and a team of experienced security specialists.

Find out more about CCL Group’s managed cyber security services here.

Sign up

Sign up to receive the latest news and insight from CCL Group.