Build vs Buy: Managed Security Services for your business
Published on 22 July 2022
With so many cyber solutions available on the market, organizations need to find a way to balance prevention with detection and response capabilities. A SOC (Security Operations Center) provides an extension of your team and delivers 24/7 capabilities. A SOC is designed to identify potential cyber security issues within the organization and isolate them in minimal time to reduce the level of impact that they can cause to business operations.
The selection of technologies and methodologies to mitigate the business impact of cyber-attacks can be challenging with a large financial overhead for businesses. The decision between an in-house SOC and the use of an outsourced one is a critical business decision to make, and it can be difficult to know which factors to start with and what to consider.
Businesses have never before been at such high risk of being targeted by threat actors and are required to make risk-based decisions on the investments that are made to improve their cyber capabilities. Here is a list of the pros and cons to help weigh up which option is the best for your business, building in-house SOC capabilities or outsourcing to an external team.
Building an in-house SOC capability
Pros
A dedicated internal team with strong reactivity
An internal SOC has the advantage of a dedicated workforce who are familiar with the company’s ecosystem and the challenges that come with it. This often allows faster reactivity in solving security problems.
Customised solutions
The solutions that are implemented within an organization are highly customized, and tailored to the company’s requirements. Organizations also have more flexibility regarding solutions being used.
Better communication
If an attack does occur, communication within the organization is often clearer and faster to react to the threat because the company uses its own means of internal communication.
Default end-to-end ownership of an incident
If an attack does occur, an internal SOC Team as a default is expected to progress the incident from its detection up to remediation. In many cases an external SOC focuses on highlighting true positive events to the organization but not their progression. However, this can also be an option with credible MSS providers who can offer integration with the organization’s existing cyber security team.
Cons
Recruitment and training
Many SOCs have high turnover of staff which is always a big challenge. A SOC requires a team of experts in multiple areas and it can take time to recruit a team and train them with the expert knowledge of the new technologies and processes required. The talent pool from which to recruit SOC analysts and cyber security experts is limited and it can take some time to fill the position within the company. Also, maintaining and developing the skills of in-house experts on new technologies, standards and processes, in-house requires time and a significant budget.
It can take years to achieve full maturity
With internal resources only being required by the internal ecosystem, the process of having a truly operational SOC is a long one. Setting up and fine-tuning the right tools is a mammoth task and it can take years to achieve full maturity. Also, it is becoming increasingly difficult to stay abreast of the threat landscape.
An internal SOC can be a big distraction from core business objectives
The SOC team in its nature is a resource-hungry and a ‘noisy’ team requiring a lot of energy, attention, nurturing, finance and time. The above can easily become a distraction in running the business. This could potentially hinder the focus on key business objectives bringing in cashflow to the organization.
Lack of appropriate documentation
Documenting processes and procedures takes time and is not easily done with limited resources who are usually spread very thin whilst getting the SOC up and running and achieving a satisfactory maturity level. Frequently, internal SOC teams have limited documentation due to these capacity issues. The result is a risk in loss of up-to-date knowledge in the event of staff departure, with updates to documentation also forgotten. In comparison, an MSS provider can leverage playbooks, processes and procedures developed by a large team of highly skilled analysts who have the luxury to focus just on documentation which is one of the foundations of operating at the scale an MSSP usually operates at.
Significant investment
The implementation of an internal SOC would need a significant initial investment with additional expenses and hidden costs. Companies that choose to build an internal SOC will have to deal with the aggregation of multiple budgets, which makes it more difficult to see what’s being spent and where. Also, implementing Tier One security solutions can often be cost-prohibitive.
“Building a SOC or buying a SOC have got their own advantages and disadvantages. Without a shadow of a doubt employing a credible MSS provider proves to be quicker, more cost effective and allows business leaders to focus on their core business objectives. The most important thing though is the awareness that, in the current threat landscape, having cyber security protection in place is not an ‘option’ but a ‘must’ unless the organization is prepared to accept the risk and deal with the potential consequences of not having it in place.”
Seb Krupowicz, UK SOC Manager, CyberCX
Hear more from Seb in this video as he describes what an MSSP is and the benefits it can bring to an organization.
Outsourced SOC
Many companies choose to outsource their security operations to avoid the significant implementation challenges that may occur. An outsourced Security Operation Center will prove to be a more cost-effective solution which allows access to a security team of experts such as CyberCX with years of industry knowledge and skills with access to Tier One security technologies.
“Knowing there is a team of specialists who look after our security operations gives us the confidence to carry out our day job and sleep peacefully at night.”
Craig Flanagan Senior ICT Services Manager
Pros
Ease of implementation
The complexity of implementing a SOC is often overlooked as it can take time to find experts in the field, set up the tools and capabilities and fine-tune them to a level where the team can use them to detect threats and analyse incidents. Another challenge is staying abreast of the current threats which are becoming increasingly sophisticated.
Speed of implementation
This can be a game-changer for your organization. In many cases, the transition from no or very limited protection to having a fully-fledged and mature SOC can be done within weeks as opposed to years!
Scalability
Scalability is another problem with in-house SOCs as organizations are failing to invest continuously in having cutting edge tools and highly skilled analysts that are required to protect the organization from a potentially highly crippling breach. This can be down to a lack of know-how or funds to support the capabilities and technology. Outsourcing a SOC allows your company to have the most up-to-date technology with experts that know how to use it.
Access to threat intelligence
By choosing to outsource SOC, organizations automatically gain access to a broader talent pool of cyber security experts with specialized skills. For example, CyberCX has 9 SOCs globally so clients are able to benefit from all the experience and learnings of these federated teams. Expert knowledge and access to the most up-to-date threat feeds is critical for businesses as cyber threats continue to evolve faster than ever. The feeds provide proactive cyber defences and threat intelligence, including research and protection against unknown threats.
No hidden costs
The initial investment to build an in-house SOC and the ongoing costs to maintain it is substantial. A Managed Security Service Provider (MSSP) is more cost effective for the organization, with full transparency of the required budget.
Bespoke package
Outsourcing SOC allows bespoke packages to be created for your company to maintain a high level of security, with the packages tailored to the specific needs of the business. In addition to this, external SOCs also have access to the latest emerging technologies and improved data sets to create more versatile capabilities.
Long-term ROI
Outsourcing a SOC can also reduce the number of operational security personnel that the company would need to hire, which is why it is often more cost effective and less time consuming compared to in-house SOC implementation and maintenance. An environment of clarity and clear understanding of roles within the cyber security team should be established by the MSSP to ensure the efficient management of time and resources.
Cons
Less knowledge of the organization
Whilst an external SOC can offer bespoke packages for your company, it’s more difficult to offer complete customisation until full knowledge of the organization is gained. An in-house team will know the full scope of an organization’s infrastructure from the outset.
Dwell time
It may take a little longer for an external SOC to fully understand an organization’s specific business needs, pain points and culture and implement the relevant processes accordingly.
As cyber security threats are becoming more common, it’s now more important than ever that an organization has SOC capabilities in place. With many security products and solutions available on the market, building an in-house SOC can seem tempting.
However, it’s worth considering hidden costs that are often underestimated when it comes to building and running an internal SOC, such as recruiting specialised experts, developing in-house tools, time needed for fine-tuning out-of-the box solutions and ongoing operational costs.
Some organizations choose to take the mixed approach by using external SOC whilst they are building in-house capabilities. In any case, once an organization outgrows the stage of starting up its business, owners will need to consider developing in-house capabilities or opting for an external SOC.
How can CyberCX help?
If you are wanting to find out more information about outsourcing your SOC via an MSSP, get in touch with one of our experts today.
