Monday, October 28, 2013

Technologies used in a SOC with costs and 2013 Gartner magic quadrants

A blog reader asked me about what kind of technologies do you need to provide managed security services so, here I am. To help you in the choice and analysis, I will link for every technology (when available) the GARTNER quadrant. Of course the quadrant is just to help you in the analysis as it is just the GARTNER point of view. Also, the "costs" are absolutely not precise, they are just to give you a clue of what you will need to invest.

Security Device Management

To provide SDM service you need basically 2 technologies:


  • Monitoring, to monitor the hardware or software faults and the performance (for ex. CPU and memory usage, storage capacity etc). There are many tools to do it, some free and some not. An example of good work is Cacti
  • Management console, to manage the technologies. Usually every vendor has its own management console. So, to manage Fortigate appliances for example, you need the Fortinet management console, for Stonesoft the SMC (Stonesoft Management Console), etc
There are not magic quadrants for the monitoring and management console but there are magic quadrants for the UTM and Enterprise Network Firewalls. This quadrants will help you in the choice of which technologies you want to provide to your customers because you can't manage EVERY technology, this is because you need specific knowledge, certifications, and having few technologies help you to industrialize the processes and procedures.

Gartner's 2013 Magic Quadrant Report for Unified Threat Management (UTM)


Gartner's 2013 Magic Quadrant Report for Enterprise Network Firewalls


Costs of the technologies:

  • Monitoring: from 0 up to 100k€. Depending if free or commercial and how many nodes do you want to monitor
  • Management: from 0 to 100k€ for every vendor. Some vendors offer it for free, some other wants a license fee.


Log Management & Correlation

To provide this service you need a log collection technology, some of this technologies support correlation between events too.

2013 Magic Quadrant for SIEM (Security Information and Event Management)


Costs:

  • Log Management, from 0 up to 100k€, depending how many eps (events per second) do you need to receive and do you need to store.
  • Log Management & Correlation, SIEM are very expensive, for 30.000eps you will need something like between 200k€ and 500k€.


Security Assessment


  • Vulnerability Assessment, for this service you will need a vulnerability assessment tool, there are many with very similar functions. Some have less false positive, some have more, but usually they are very similar (some vendors will kill me if they read this! hehe). In general, I think it's really better to focus on the "easy to understand" reports than on the ability to find 1-2 more vulnerabilities. 
  • Penetration Test, for this you will need an exploting framework, needed for penetration tests, web application assessments, etc (there are free like metasploit and commercial like Core Impact)

Gartner 2013 "Marketscope for Vulnerability Assessment tools"


Costs:

  • Vulnerability assessment, between 100 and 200k€.
  • Exploting framework, from 0 to 100k€
  • Other tools used in PT, from 0 to 20/30k€

Early Warning

There is not really a technology to provide this service, you should build one for yourself. When you start with few customers, you can do it easily "by hand", when you reach 10/15 customers then the things become more difficult and you will need to build a custom technology.

DDoS Mitigation

To provide a DDoS mitigation service you will need a traffic cleaning platform aka "washing machine". As far as I know there are just two main vendors: Radware and Arbor.

Costs:

  • Between 100 and 200k€ for every traffic cleaning platform, able to clean 5-10GB/s of traffic

I hope you enjoyed this post and has been useful for your work. If you have any question or you want to suggest me a new blog post, please write me by email or comments.
Thanks for reading this.


13 comments:

  1. I’m very affectionate of your blogging and redistribution. Gamingguide

    ReplyDelete
  2. Thank you so much for sharing information about gartner magic quadrant security.

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. When it comes to SIEM and security, it is important to have a fully transparent source code, so for log management, I'd definitely go with an open source project, like NXLog, which provides high performance and scalability, and it's free to download to get started with.

    ReplyDelete
  5. This all came about because a sitting President had the courage and took the leadership to lay the groundwork for the United States to act on a decisive plan of direction which open up so many windows of opportunity for millions of Americans.guarantor loans

    ReplyDelete
  6. Professionally written blogs are rare to find, however I appreciate all the points mentioned here. I also want to include some other writing skills which everyone must aware of. cyber security firm

    ReplyDelete
  7. This comment has been removed by the author.

    ReplyDelete
  8. Wow. This blog provide complete information on how to build Security Operations Centre. Cyber security SOC are very important for you to take care of its information assets, as they are most important for the sake of it.

    ReplyDelete
  9. The main security camera was a c-mount security camera, and they were first presented in the 1970's. BestSecurityPlace

    ReplyDelete
  10. hidden security system is becoming a necessary part to keep a proper safeguarding at any location ensuring the safety of the place. business security camera system installation

    ReplyDelete
  11. With the assist of Shameera wiest’s blog, humans will come to recognize new techniques for their portray, drawing in addition to photographical hobby. This group is helping humans to recognize special strategies for drawing and painting and i'm glad to wend deep of this weblog.
    Best IT Salary Guide

    ReplyDelete
  12. Security is of paramount concern nowadays when crime records have almost tripled since the last decade. Most people prefer to hire agents coming from reputed security guard companies security guard

    ReplyDelete
  13. According to the 2012 report, Global Trends 2030: Alternative Worlds, published the US National Intelligence Council, four technology arenas will shape global economic, social and military developments by 2030. MSI H100M Gaming

    ReplyDelete