Analysis of the Functionalities of a Shared ICS Security Operations Center

Abstract

The basic step in the design of a security operations center (SOC) is identifying the necessary functions it needs to perform. The article offers an analysis of the ICS SOC functionalities and is focused to create a part of the concept of operations before the real design of Shared ICS SOC. We offer a complex of functionalities of Shared ICS SOC and analyze their effectiveness. The survey is based on a review of the legal framework, the ICS security incidents, research on the gaps between cybersecurity products and real needs for the ICS and SCADA community. Shared SOC performs role of community service hub with integrated experience, supplying security services for multiple ICS. By outsourcing these services, a company can reduce security staff and focus on its core business.