Do we need a SOC if we have only one IT administrator?
No, but you do need a plan for the hours when that administrator is not there. A SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks. (security operations centre) is a team watching alerts around the clock; a company with one administrator cannot staff one and usually does not need to. What it needs is narrower: detection that runs on its own, alerts short and clear enough to act on, a second person who receives them when the admin is away, and a phone number for an incident-response firm. Write down who decides to disconnect a machine or the internet line in an emergency. Keep the basics in place: multi-factor authentication, updates, endpoint protection and offline backups. NetSenX was built for this situation: one agent on a mirror port watches a whole segment, every alert is explained in plain language, and alerts go by e-mail on every plan, so they can reach a deputy or your IT provider as well.
Read next
Related questions
Terms used here
- SOC (security operations centre)
- A team, often working around the clock, whose job is to watch for and respond to attacks.