Threat Level: green Handler on Duty: Jan Kopriva

SANS ISC: calculation on SOC human bodies required SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
calculation on SOC human bodies required
Does any one know of a resource that can calculate the amount of bodies for Tier 1, Tier 2
required for a NOC or SOC.

We are trying to justify the increased body count is the purpose.

Example:

If we are running 2000 servers and 2500 DB's and they generate 8 million events per day how many persons in tier one would
I need to work the SOC/NOC to monitor that and escalate that to Tier 2. and How many tier two would I need as SME to resolve that.

I found this link from HP for calculation but it is based physical racks in a DC. But I need something similar
but more for software or data.

4.1.1 Personnel Costs
Personnel cost may be considered in terms of number of information technology (IT)
facilities and administrative resources utilized per rack per month. These are internal
personnel (excluding those covered by preventive maintenance contracts for power and
cooling equipment) utilized per rack in a data center. Including costs for the average
number of IT personnel per rack (M1), the average number of facilities personnel per rack
(M2), and the average number of administrative personnel per rack (M3), the total
personnel costs are obtained as follows:
( 1 2 3 ) avg total avg
per rack
Cost personnel = M + M + M S = M S (4.1)
Example
Suppose the average fully loaded cost of personnel in a data center is $10,000 per month
(i.e. Savg = $10,000). Then, for a fraction of resource – say Mtotal = 0.05 (i.e. one person
for every 20 racks), the personnel cost on a per rack basis is $500 per month.

I need something similar but for staffing a NOC/SOC.
Really a SOC but they are similar.

Event corrolation versus number of staff to monitor and triage it at Tier-1;
then Tier-2 PER System or per # of DB's, etc.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!