SANS: Building a World-Class Security Operations Center: A Roadmap

For organizations without a formalized incident-handling capability, the creation from scratch of a security operations center that enables centralized visibility, alerting and investigation can be a daunting task. But fortunately organizations don’t need a room full of security experts and an investment of millions of dollars in security systems to make progress here. In this paper we look at how to develop an effective security operations center (SOC) and provide a roadmap for continuously evolving this capability to keep pace with the tactics of the adversaries