In Taiwan, all of the class A government organizations have to set up their Security Operation Center (SOC) before year . The number of SOC construction projects has been increasing recently in certain industries including finance and high-tech manufacturing due to the pressing needs for enterprise to meet the regulation requirements. Typically, there are three different ways to establish a SOC, i.e. Outsourcing, Cooperation by time-sharing and Self-Constructing. . The former two methods rely on ’complete trust’to the outsourcing partners and could be suitable for those enterprises who are lacking of in-house security professionals.
The “Self-Constructing” method means enterprises purchase security equipments by themselves and their IT staffs will perform the 24 x 7 monitoring jobs. This solution is suitable for those organizations that deal with highly confidential affairs and it ensures much higher security. However, the challenge comes from a huge workload of performing monitoring, analysis and forensics professionally. Not only security expertises of personnel need to be improved, the selection of proper security appliances that provide necessary functionalities and friendly user interface is the key factor affecting the SOC operating cost and its effectiveness and efficiency.
RetiVista (v4.2.1) from RETI Corporation is a flexible and scalable platform to help enterprise self-construct its own SOC. It monitors all of the networking activities and records packets of information passed through network. It provides a statistics tool to count up risks index by users ranking and generates numerous useful and easy-to-read reports. RetiVista helps forensics personnel skip over technical barriers and get down to the issues right away. The forensics personnel can evaluate network risks quickly, conduct real-time monitoring and analysis, review analysis reports systematically and make alarms to information leaks immediately.