U.S. Federal Government: Embracing Security Operations Center (SOC) as a Service?

Enough federal government agencies are outsourcing security operations center (SOC) capabilities to off-site facilities that within the next few years dedicated, on-premise teams providing continuous support will be relegated to the back seat, a government security official said.

A combination of budget constraints and understaffed SOCs is pressuring agencies to “consider the reality” of centralizing security operations across the federal government, wrote Dan Jacobs, the General Services Administration’s (GSA) cybersecurity coordinator of the identity, credential and access management team, in a recent blog post. (Note #1: Earlier this summer Jacobs advocated for SOCaaS use in federal agencies in remarks at researcher Gartner’s 2018 security conference. His blog elaborates on the presentation.)

Enter SOC as a service (SOCaaS). “If agencies contract out security operations, they are using SOC as a service and can leverage this model to streamline security operations,” he said. (Note #2: Artic Wolf Networks' AWN CyberSOC platform is an example of an SOCaaS model).

SOC as a Service: Potential U.S. Government Approaches

There are two scenarios in which the feds could adopt a SOCaaS model, Jacobs said. In one script (which he called “probable”), a large Tier 1 SOC would provide 80 percent of security operations standardized across all agencies, with smaller Tier 2 and Tier 3 centers filling in the services not covered by the Tier 1 operation.

However, in another scenario (which Jacobs termed the “most likely outcome”), a Tier 1 SOC would provide a limited number of services common to all agencies while the Tier 2 and Tier 3 operations would deliver security services tailored to each agency’s specific needs.

Either way, under a centralized model a best of breed/larger organization would be the Tier 1 SOC provider. “In both cases, the goal is to combine the capabilities and services provided by a best of breed organization,” said Jacobs. Ultimately, the plan would be for the GSA to build out these services for purchase by the federal government. That outcome, however, is “years away from becoming reality,” he said.

SOC as a Service: For Recommendations

Here are four of Jacobs’ recommendations for how the feds could adopt SOCaaS:

“Centralized security operational services, such as SOCaaS, are likely to become a reality over the next several years,” wrote Jacobs. “While some agencies already have capabilities and services to improve management of security operation, many have not yet started down this path.”

Examples of SOC as a Service

SOC as a Service is becoming increasingly more popular in several industry sectors -- including the higher education market and the MSP-driven SMB sector. Examples include:

Additional insights from Joe Panettieri.