Managed Security Operations Centre (SOCaaS)

Challenge

The client needed to upgrade their security posture by replacing an incumbent endpoint security solution with a modern, integrated Managed Security Operations Center (SOC) service. Key challenges included integrating new Endpoint Detection and Response (EDR), Network Detection and Response (NDR), Security Information and Event Management (SIEM) and Threat Intelligence (TI) technologies within a tight timeframe across multiple European, Asia and US sites while ensuring cost efficiencies.

Solution

CyberQ Group proposed a comprehensive 24×7 managed SOC service. This integrated solution leveraged a unified platform which incorporated a leading EDR platform, a software-based NDR tool, an SIEM platform, and threat intelligence feeds. The service encompassed monitoring, threat detection, response, hunting, incident handling, and service management, aiming for enhanced visibility and potentially reduced SIEM data costs.

Implementation

A phased approach was adopted, starting with design workshops and technical architecture finalisation, followed by deploying agents using standard enterprise deployment tools. The process involved significant client collaboration, including addressing Privacy Impact assessment, establishing Early Life Support procedures, developing custom incident playbooks, and holding regular update meetings. Minor delays and coordinating client-side change management were managed proactively.

Conclusion

This engagement highlights the successful initiation of a complex managed SOC transition. By implementing an integrated security technology stack and fostering close collaboration, CyberQ Group addressed the client’s need for enhanced, modernised security operations across its global footprint within an ambitious schedule.

Ongoing Results

By leveraging CyberQ Groups SOC as a Service, the retailer significantly reduced data ingestion volumes (~45TB per year) compared to their previous SIEM, leading to substantial cost savings. 

Furthermore, the seamless integration with their existing Microsoft E5 suite enhanced security workflows and automation. The retailer also experienced a marked improvement in their Mean Time To Detect (MTTD) and Mean Time To Respond (MTTR), enabling them to identify and neutralise threats more rapidly and effectively, minimising potential disruption to their operations and maintaining customer trust.