In Security Operations Centres (SOCs) security practitioners work using a range of tools to detect and mitigate malicious computer-network activity. Sonification, in which data is represented as sound, is said to have potential as an approach to addressing some of the unique challenges faced by SOCs. For example, sonification has been shown to enable peripheral monitoring of processes, which could aid practitioners multitasking in busy SOCs. The perspectives of security practitioners on incorporating sonification into their actual working environments have not yet been examined, however. The aim of this paper therefore is to address this gap by exploring attitudes to using sonification in SOCs. We report on the results of a study consisting of an online survey (N=20) and interviews (N=21) with security practitioners working in a range of different SOCs. Our contribution is a refined appreciation of the contexts in which sonification could aid in SOC working practice, and an understanding of the areas in which sonification may not be beneficial or may even be problematic.We also analyse the critical requirements for the design of sonification systems and their integration into the SOC setting. Our findings clarify insights into the potential benefits and challenges of introducing sonification to support work in this vital security-monitoring environment.
The objective of a SOC is primarily to mitigate cybersecurity threats towards the organisations for which they are responsible @cite_49 . Internal SOCs are responsible for the organisations they are placed within, while multitenanted SOCs monitor network security on behalf of multiple client organisations. Figure is an example of a SOC, with security data presented to security practitioners on computer monitors. Practitioners are frequently required to work long shifts, including night shifts, looking at multiple screens for extended time periods @cite_45 . The resulting pressure and demanding nature of SOC work have been highlighted in HCI research @cite_24 @cite_40 .
@cite_24 @cite_40 @cite_45 @cite_49
1941037119 2040576886 2615396116
Security Operation Centers (SOCs) are being operated by universities, government agencies, and corporations to defend their enterprise networks in general and in particular to identify malicious behaviors in both networks and hosts. The success of a SOC depends on having the right tools, processes and, most importantly, efficient and effective analysts. One of the worrying issues in recent times has been the consistently high burnout rates of security analysts in SOCs. Burnout results in analysts making poor judgments when analyzing security events as well as frequent personnel turnovers. In spite of high awareness of this problem, little has been known so far about the factors leading to burnout. Various coping strategies employed by SOC management such as career progression do not seem to address the problem but rather deal only with the symptoms. In short, burnout is a manifestation of one or more underlying issues in SOCs that are as of yet unknown. In this work we performed an anthropological study of a corporate SOC over a period of six months and identified concrete factors contributing to the burnout phenomenon. We use Grounded Theory to analyze our fieldwork data and propose a model that explains the burnout phenomenon. Our model indicates that burnout is a human capital management problem resulting from the cyclic interaction of a number of human, technical, and managerial factors. Specifically, we identified multiple vicious cycles connecting the factors affecting the morale of the analysts. In this paper we provide detailed descriptions of the various vicious cycles and suggest ways to turn these cycles into virtuous ones. We further validated our results on the fieldnotes from a SOC at a higher education institution. The proposed model is able to successfully capture and explain the burnout symptoms in this other SOC as well. Security researchers have been trying to understand functioning of a security operation center (SOC) and how security analysts perform their job. This effort is motivated by the fact that security monitoring and analysis is not just a technical problem. Researchers must take into consideration the human and organizational factors for their research ideas to succeed. Much work towards this direction has been through interviews of security analysts in SOCs. Interviews, however useful, will not be always possible as analysts work in a high-stress and time constrained environment. Thus the understanding of operational challenges through interviews is quite shallow. There is also an issue of trust that limits the amount of information an analyst shares with an interviewing researcher. In our work, we take an anthropological approach to address this problem. Students with Computer Science background get trained in anthropological methods by an anthropologist and are embedded as security analysts in operation centers. Embedded students perform the same job as an analyst and see the operational world from the view point of an analyst. Through reflection on the observations made by the students we gain a holistic perspective of the challenges in operation centers. In this paper we report preliminary results on the ongoing fieldwork at two corporate and a University SOC. Security Operation Centers (SOCs) are being operated by universities, government agencies, and corporations to defend their enterprise networks and identify and thwart malicious behaviors in both networks and hosts. The success of a SOC depends on combining good tools and processes with efficient and effective analysts. During four years of anthropological fieldwork methods to study SOCs, the authors discovered that successful SOC innovations must resolve multiple internal and external conflicts to be effective and efficient. This discovery, guided by activity theory (AT) as a framework for analyzing the fieldwork data, enabled them understand these realities. Their research indicates conflict resolution is a prerequisite for continuous improvement of SOCs in both human and technological aspects. Failure to do so can lead to adverse effects, such as analyst burnout and reduction in overall effectiveness.