The advantages of the cloud when setting up a SOC

{"title":"The advantages of the cloud when setting up a SOC","content":"

The advantages of the cloud when setting up a SOC

Setting up and operating a Security Operations Centre (SOC) requires thorough planning and answers to many important questions. Aspects such as the infrastructure architecture, the required resources, data availability and storage, the desired technology stack and the technological options play a decisive role. However, one of the fundamental decisions you will have to make is where to operate your SOC: in a central data centre or in the cloud. In this article, we explain why the cloud may be the optimal choice.

Operating costs for the SOC platform 

A powerful SOC requires at least one Security Information and Event Management (SIEM) system and a vulnerability scanner. This means that 5-10 virtual machines must be provided on which the operating system supported by the SIEM runs. Some of these components are available as ready-made applications and do not need to be further customised. You also need databases, user and service accounts and authorisations for these accounts. As a SIEM receives data from different networks, firewall authorisations are also required.

The effort required to operate a SOC is considerable and must be carried out continuously, as the requirements for the SOC architecture change over time. Using a cloud platform instead of an on-premise solution can significantly reduce the burden on the operations team as many of these efforts are eliminated.

Operating costs for log management and maintenance 

A SIEM system is only as effective as the data it processes. In order to realistically estimate the operating costs, you need to know which assets or asset classes the data originates from, where these assets are located and how the data gets from the source to the SIEM. Sufficient bandwidth must also be available to transfer the data in an acceptable amount of time. In most cases, it is more efficient to move the log data to the cloud, especially if your management platforms are already operating in the cloud.

IT resources for the infrastructure 

To ensure that your SOC works reliably and in real time, you need sufficient hard disk space, highly available systems and a high-performance infrastructure. A SIEM system needs fast SSDs and RAM to work efficiently. The resource requirements for a SIEM are often higher than expected and remain largely unchanged, regardless of whether you opt for a cloud or an on-premise solution. However, resource costs are usually cheaper in the cloud, as the large providers offer unlimited capacity and favourable offers. 

Conclusion

Why do some people decide against the cloud for their SOC? One of the main reasons is the desire for complete control over their own data. The idea of sensitive information being stored outside of one's own sphere of influence can be a deterrent. Data protection concerns are often cited as an argument against the cloud.

In most cases, however, the advantages outweigh the disadvantages. Practice shows that companies use cloud solutions such as Office 365 to store data cost-effectively and efficiently. Data protection compliant solutions are perfectly feasible in the cloud and offer an excellent opportunity to save resources and reduce operational overheads. 

All in all, the decision to operate a SOC in the cloud is a sensible choice to reduce operating costs, increase efficiency and ensure data protection. The cloud offers a cost-effective and powerful alternative to on-premise infrastructure that meets the requirements of modern SOC architectures.","model_type":"blog","model_id":"6ae46999b0394aecb7d6d245662db8ab","lang_id":"ba9172a5b8524875800254af8d330131","published":true,"inherited":true,"created_at":"2025-05-16T23:58:50.577Z","updated_at":"2025-05-16T23:59:48.000Z","slug":"The-advantages-of-the-cloud-when-setting-up-a-SOC"}