A Data-Center Protection System Based on a Security Operations Center (SOC): A Comparative Architectural Framework and Performance-Indicator Analysis
DOI:
https://doi.org/10.54878/tq4szd72Keywords:
security operations center, data-center protection, SIEM, SOAR, zero trust, SOC maturity, NIST CSF 2.0Abstract
Data centers have become a critical node of the digital economy, hosting identity systems, cloud services, business applications, and facility-operation technologies. As the attack surface expands and workloads migrate to hybrid and multi-cloud environments, perimeter-only controls are no longer sufficient. This study examines the Security Operations Center (SOC) as an operational protection system for data centers rather than a mere collection of monitoring tools. The research follows a comparative analytical method that synthesizes peer-reviewed literature published from 2020 onward, official industry and agency reports (IBM, Verizon, ENISA, and Uptime Institute), and authoritative frameworks (NIST CSF 2.0, NIST SP 800-61r3, ISO/IEC 27001:2022, ISO/IEC 27035:2023, and the NIS 2 Directive). The evidence shows that the global average cost of a data breach was USD 4.44 million in IBM’s 2025 report and rose to USD 4.99 million in the 2026 report, while mean time to identify and contain fell to 241 days; ransomware appeared in 44% of breaches analyzed by Verizon in 2025; and distributed denial-of-service remains the most frequently observed threat in the European landscape. The paper proposes a six-layer DC-SOC model that integrates cyber telemetry with cyber-physical facility signals (BMS/OT) and risk-based governance. Effectiveness, the study concludes, is not achieved by procuring a single platform, but by balancing people, process, and technology and by measuring maturity through MTTD, MTTR, and analysis quality rather than raw alert volume.
References
Vielberth, M., Böhm, F., Fichtinger, I., & Pernul, G. (2020). Security operations center: A systematic study and open challenges. IEEE Access, 8, 227756–227779. https://doi.org/10.1109/ACCESS.2020.3045514
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST Cybersecurity White Paper CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
National Institute of Standards and Technology. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST Special Publication 800-61 Rev. 3). https://doi.org/10.6028/NIST.SP.800-61r3
IBM. (2025). Cost of a data breach report 2025. IBM Corporation.
IBM. (2026). Cost of a data breach report 2026. IBM Corporation.
Verizon. (2025). 2025 data breach investigations report. Verizon Business.
European Union Agency for Cybersecurity. (2024). ENISA threat landscape 2024. ENISA. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024
European Union Agency for Cybersecurity. (2025). ENISA threat landscape 2025. ENISA. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
International Organization for Standardization. (2022). Information security, cybersecurity and privacy protection — Information security management systems — Requirements (ISO/IEC 27001:2022).
International Organization for Standardization. (2023). Information technology — Information security incident management — Part 1: Principles and process (ISO/IEC 27035-1:2023).
International Organization for Standardization. (2023). Information technology — Information security incident management — Part 2: Guidelines to plan and prepare for incident response (ISO/IEC 27035-2:2023).
Agyepong, E., Cherdantseva, Y., Reinecke, P., & Burnap, P. (2022). A systematic method for measuring the performance of a cyber security operations centre analyst. Computers & Security, 124, Article 102959. https://doi.org/10.1016/j.cose.2022.102959
Alahmadi, B. A., Axon, L., & Martinovic, I. (2022). 99% false positives: A qualitative study of SOC analysts’ perspectives on security alarms. In 31st USENIX Security Symposium (USENIX Security 22) (pp. 2783–2800). USENIX Association. https://www.usenix.org/conference/usenixsecurity22/presentation/alahmadi
Tariq, S., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2025). Alert fatigue in security operations centres: Research challenges and opportunities. ACM Computing Surveys, 57(9), 1–38. https://doi.org/10.1145/3723158
Bassey, C., Chinda, E. T., & Idowu, S. (2024). Building a scalable security operations center: A focus on open-source tools. Journal of Engineering Research and Reports, 26(7), 196–209. https://doi.org/10.9734/jerr/2024/v26i71203
da Silva, D. A., Costa, J. L., & Almeida, J. R. (2024). Infrastructural challenges and good practices in a security operation center. In 13th Symposium on Languages, Applications and Technologies (SLATE 2024) (Open Access Series in Informatics, Vol. 120, Article 13). Schloss Dagstuhl – Leibniz-Zentrum für Informatik. https://doi.org/10.4230/OASIcs.SLATE.2024.13
European Parliament & Council of the European Union. (2022). Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, L 333, 80–152. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
