The Role of SOCs for Critical Infrastructure Providers

Cyber security is a challenge for all organizations and companies, especially for those classified as critical infrastructure providers, such as hospitals and energy providers. Attempts to prevent or fight against cyberattacks are various., Therefore, critical infrastructure providers remain searching for an institutionalized solution. Security operation centers (SOCs) seem to offer an opportunity to tackle this issue, but to date, it remains unclear, what influenced the implementation of a SOC. Directly bound to cyber security and business continuity management, the strategic role of SOCs has been addressed, previously. The role that SOCs play for critical infrastructure providers still needs to be clarified. Our case study shows, that decisions for implementing a SOC are influenced by different perspectives, i.e., strategic, socio-technical, and solution-implementation perspectives. All three perspectives share factors with existing cyber security research but also give new insights, particularly regarding the social aspects of SOC staff and the fact that businesses are in favor of an outsourced SOC to benefit from shared resources, reduced costs and skilled staff.