Translated from 日本語 • View original 
Case Study (1): Operational failure due to lack of human resources → Stabilization through outsourcing
[Background] Challenge to in-house production in our own SOC
Company A is a manufacturing company with a global footprint. In order to strengthen information leakage countermeasures and a 24-hour monitoring system, we decided to launch our own SOC.
Five security engineers were hired and monitoring work began in shifts. However, within six months of operation, the following issues emerged:
[Issue] Operational collapse due to lack of personnel and increased burden
- Increased turnover: Engineers are leaving one after another due to the heavy burden of dealing with nighttime and holidays. As a result, the shift will not turn.
- Lack of skills: Although cyberattacks are becoming more sophisticated every year, internal members alone cannot keep up with the response.
- Increased operational load: It is difficult to balance incident response and daily operations with limited personnel, and operational efficiency is significantly reduced.
[Result] Switching to outsourcing
Company A found it difficult to continue operations and switched to an external SOC service. Results:
- Maintain a 24-hour, 365-day monitoring system
- Compatible with the latest attack methods
- Allow your engineers to focus on their core work
Lesson learned: "In-house resources alone can lead to operational failure"
It is more stable and efficient to leave professional monitoring to external professionals.
Case Study (2): Misunderstanding Operational Costs → Exceeding Budget with Hidden Costs
[Background] Aiming to reduce costs by in-house production
Company B is an IT company that secures a security budget of hundreds of millions of yen per year.
We thought that if we made the SOC in-house, we would be able to reduce operational costs, so we introduced a SIEM (Security Information Event Management) tool and set up a dedicated team.
[Challenge] Increasing invisible costs
- Higher tool maintenance costs: SIEM tools are charged based on the amount of logs, so the amount of data swelled more than expected after operation, and the cost jumped.
- Increased operational man-hours: Incident response and tuning took more man-hours than expected, resulting in increased overtime and labor costs for engineers.
- Increased Education Costs: Regular training was required to maintain specialized skills, making education costs more inflated than expected.
[Result] Successful cost reduction through outsourcing
Company B continued to exceed costs, so they eventually outsourced SOC operations. Results:
- Fixed monthly fee for easy cost forecasting
- Monitored by a dedicated team for quick response
- No need to pay for the training of in-house engineers
Lesson: "In-house SOC is difficult to control costs"
External SOCs are easy to manage budgets and are often cost-effective.
Case Study (3): Decreased detection accuracy → Rapid response through outsourcing
[Background] False positive problem in the company's SOC
Company C is in the financial industry and has built its own SOC to strengthen security.
At the beginning of the operation, we focused on tuning the detection rules, and the incident response was smooth.
[Challenge] False positives and response delays occur
- Frequent false positives: Tuning cannot keep up, and false positives are frequent. They are overwhelmed by responses and delay in responding to important alerts that should have been responded to.
- Increased risk due to delayed response: Responding to legitimate incidents was delayed, delaying initial response when an attack was detected.
[Result] Outsourcing improves detection accuracy and response speed
Company C gained the following benefits by switching to an external SOC:
- Highly accurate alert identification by expert analysts
- Rapid response and containment of incidents
- Tuning with the latest threat intelligence reduces false positive rates
Lesson: "Expertise and know-how are essential for combating false positives"
External SOC reduces false positive rates while enabling rapid response.
Summary: The Advantages of Outsourcing
As you can see from these examples, the following challenges are likely to arise when operating a SOC in-house:
- Increased burden and operational bankruptcy due to lack of human resources
- Budget overruns due to unexpected hidden costs
- Increased security risks due to false positives and delays in response
On the other hand, if you are an outsourced SOC:
- Stable operation 24 hours a day, 365 days a year
- Rapid response with high expertise and the latest technology
- Easy cost prediction and easy to manage TCO
Rather than "switching to outsourcing after failing in your own operation", you can efficiently strengthen security while reducing costs and risks by considering outsourcing from the beginning.
**Achieve Efficient Operations with Colorkrew Security's SOC! **
Some of you may feel that the cases introduced so far may be a little familiar to you.
For example,
- Lack of personnel has burdened nighttime response and incident response
- Frequent false positives and risk missing real threats to address
- Tools and talent retention costs are higher than expected
If you are worried about whether you should continue to operate with your own SOC in this situation, why not consider outsourcing as an option?
Colorkrew Security provides strong support for your security operations with 24/365 monitoring and the latest threat intelligence.
We also provide support to reduce operational load and propose operational efficiency, so please feel free to contact us even if you want to hear from us as part of our information gathering.
We hope that we will work together to think about the optimal operation system according to your company's situation!