SOC (Security Operation Center)

In the past

the idea was to have PCs, “weak” devices protected by the company’s IT infrastructure (ICT), e.g. with Firewall / VPN etc., and this protection barrier is represented by the blue rectangle, which is often also a border, a physical perimeter. But this wall is extremely fragile and is violated when surfing the internet, by new connectivity software such as AnyDesk, by unknown software introduced into the company in the laptops of people who visit the company, etc…

For this reason, we prefer to use another approach:

Individual devices, individual PCs are strengthened. At this point, whether there is an outer protective wall or not is not important.

But what strengthens a PC/Device? 3 Things:

Monitoring (1) which is a function that monitors the proper functioning of the PC/device.

Asset Management (2) is knowing exactly what hardware and software is on the device in order to be able to automatically update software so that it contains as few vulnerabilities as possible.

End Point Protection (3) is both antivirus and Internet access protection.

Then all the PCs/Devices of a certain Company/Organization are no longer the PCs that are inside its perimeter, at a certain location. But it is all and only the PCs/devices that are controlled/managed by a single operations center, a single control function, a single SOC.

Question: but if we have set up this SOC for a certain Company/Organization, is it still necessary to have strong perimetral walls/protections?
Answer: Yes, because in the company there are many devices on which SOC service agents cannot be installed, and therefore there is still a need for some kind of “wall“, a perimetral protection.