SOC-It-To-You Security

Some solution providers are looking at building a SOC at a client site as an alterative to the traditional managed security model, in which a customer's network is monitored remotely by a third party.

Bruce Tucker, president of Patriot Technologies, a Frederick, Md.-based security services firm, said some of his federal accounts are interested in shrink-wrapped SOCs.

"They may still feel unsure about allowing a third party off-site to collect their Internet traffic," he said. "If that's the case, the opportunity [for us is, 'Let us build our expertise and infrastructure and the way we run a managed service provider business in your agency.' "

Patriot partners with managed security provider Riptech, Alexandria, Va., which has discussed building on-site SOCs with some federal agencies, said Rob Cahill, Riptech's director of federal sales.

"There has been a lot of interest," Cahill said. Although he would not specify how much such a solution would cost, he did say it would be a "high-dollar item."

Riptech, which was acquired by Symantec last week, could build a SOC that allows an agency to use its proprietary Caltarian technology to track and analyze security events on the network, and would have a technician on-site who could train staffers on the technology, he said.

Vigilinx, a security services firm in Parsippany, N.J., also is talking with customers about designing and implementing a SOC for them, said Adam Lipson, Vigilinx's executive vice president of client services and product development.

"It's absolutely something we would do," Lipson said.

A shrink-wrapped SOC would include designing the facility and its physical security, backup and fail-over requirements as well as developing security event procedures and policies, he said. Vigilinx could staff the SOC if the customer requests, Lipson added.

The cost would vary, depending on the types of services and technologies included in the SOC, he said.

Darwin Herdman, CTO of RedSiren, a Pittsburgh-based security services firm, said staffers who can analyze and assess security data are key, which makes a SOC-in-a-box a difficult proposition.

"It's data aggregation, and I still haven't seen anyone be able to put it in a box," he said.