Many financial services firms are re evaluating whether their security operations centre should sit with the same provider that manages their IT, or whether keeping them separate offers better protection. In this video MD Henry Duncombe and CTO Dan O’Hara explore why close alignment between SOC and IT teams can actually strengthen threat detection and when independent cyber assurance genuinely makes sense.
Video transcript
Should your SOC be separate from your IT provider?
A question we get asked a lot is whether your security operations centre (SOC) or security provider should be the same as your IT managed service provider, or if they should be separate.
This is a question that is as old as time and generates a lot of debate. The traditional thinking is that perhaps there should be some separation between the two. The fear is that if the people managing your IT and the people managing your security are from the same organisation, they might end up marking their own homework.
The benefits of a combined provider
There are actually huge benefits to having your SOC and your IT with the same provider. The whole purpose of a security operations centre is to build up a picture of what is normal and what is not.
The closer that security team can be to the wider technology team, the better. Working off the same information and data allows them to build up a clear picture of users, applications, and locations. This makes it much easier to understand what is normal, what isn't, and to pick up on the things that truly need investigating.
If there is a separation there, the security team clearly won't have the full picture. It also introduces potential friction or delays because you are dealing with two separate firms and two separate businesses.
Where does the argument for separation come from?
There is limited validity to the idea that the two must be kept separate, and it helps to understand where this argument comes from.
It is considered good practice to have an independent security company doing what is known as cyber assurance. This includes activities like:
- Penetration testing: Actively trying to test the defences of your cyber team to see what vulnerabilities and weaknesses can be exploited.
- Security architecture reviews: Looking independently at your security standards.
There is a lot of validity in having an independent, outside view—much like an external auditor—looking at those elements. The challenge is that people have gotten a little bit confused. They think that because assurance should be independent, the whole of cyber security must be separate.
When it comes to the operational side, you want your cyber team to have the most up-to-date, holistic picture of your business as possible. Therefore, having them sit centrally with the rest of your IT team makes a lot of sense.
Scale and complexity
There are scenarios where it does make sense to have a separate, dedicated SOC team. If you are a larger company with lots of different locations, high complexity, and a mix of legacy systems alongside the cloud, a separate SOC can make sense.
However, independent, more boutique financial services firms simply don't have that scale or complexity. For those firms, it makes much more sense to have as much as possible managed in one central place.
