Cyber Security Centres for Threat Detection and Mitigation
Marthie M. Grobler, Pierre Jacobs, Brett van Niekerk · Advances in information security, privacy, and ethics book series · 2016
With the continuing evolution of cyber threats, it is only a matter of time before an organisation will suffer a major breach or there is an incident of national significance. This necessitates monitoring to detect possible incidents and mechanisms to respond and recover from breaches. This chapter provides an overview of structures to aid in threat detection and incident recovery. Security Operation Centres (SOCs), Computer Security Incident Response Teams (CSIRTs), and Security Intelligence Centres (SICs) will be covered, and the differences, benefits and limitations will be discussed. Guidance for the implementation of these security capabilities within organisations will be provided.