Learn in the textbookOrganizational Structure for Promoting Security
DefinitionA SOC (Security Operation Center, read "sock" in Japanese) is an organization that continuously monitors network and server traffic and logs, and detects and analyzes signs of attack.
ExplanationThe full name is Security Operation Center, and it often keeps watch 24 hours a day. When it detects an anomaly, it judges how serious it is and then alerts a response team such as the CSIRT. Because the work needs analytical skill and staff on rotating shifts, some organizations outsource monitoring to a specialist provider.
AnalogyIt is like a weather service. It keeps observing day and night, and when it spots signs of danger it issues a warning so that local authorities and others can respond.
Memory hookThe O in SOC stands for Operation, which reminds you that it keeps watch as part of the day-to-day operation that keeps systems running.