Security Operations Center (SOC)

IT security incidents are a major threat to businesses and authorities. Denial-of-service attacks (DoS), phishing, ransomware or business email compromise (BEC) are just some of the threats that can have devastating consequences. Cyberattacks are becoming increasingly precise, combining multiple angles of attack.

Conventional IT security measures like firewalls, malware scanners or intrusion detection systems are not enough to detect attacks in time and take effective countermeasures.

Legal provisions, such as the EU’s General Data Protection Regulation (GDPR) or Germany’s IT Security Act (IT-Sicherheitsgesetz), also require companies and organizations to verifiably provide up-to-date protection for their IT systems and data and immediately report security incidents to the responsible supervisory authority.

Greater security and compliance

A security operations center (SOC) is an important tool for detecting and defending against current IT security threats and supporting IT compliance. The most important tasks of the SOC are:

• Detecting suspicious activities in your IT infrastructure
• Sounding the alarm in the event of critical incidents
• Initiating effective countermeasures

There is a wide range of events that an SOC can deem to be unusual. They can be a sign of an ongoing attack, a compromised system, activities by a malicious insider or a loss of performance. These are all very complex events. That is why operating an SOC requires experienced and well-trained security specialists.

At our headquarters in Wiesbaden, we at SVA operate an SOC that is available around the clock and can offer you four frequently required service elements as part of a modular offering

• SVA security intelligence platform
  Provision and operation of a central platform for security event management and analysis.
• Network traffic and behavior analysis
  Additional network traffic data for the security intelligence platform.
• Emergency response service
  Comprehensive support to minimize damage and forensics in the event of a security incident.
• Security monitoring
  Continuous monitoring and analysis of security incidents by security specialists, including alerting.

Security monitoring

An experienced team of specialists in the SVA Security Operation Center (SVA SOC) monitors all incidents identified by the security intelligence platform. This data is automatically combined with information from countless threat intelligence sources and is manually analyzed by the SVA SOC specialists in order to determine whether the incident has an impact on security and requires further action. The possible steps include alerting the customer, taking immediate action based on a predefined plan, or calling on the SVA Cyber Defense Team.