No abstract

Security researchers have been trying to understand functioning of a security operation center (SOC) and how security analysts perform their job. This effort is motivated by the fact that security monitoring and analysis is not just a technical problem. Researchers must take into consideration the human and organizational factors for their research ideas to succeed. Much work towards this direction has been through interviews of security analysts in SOCs. Interviews, however useful, will not be always possible as analysts work in a high-stress and time constrained environment. Thus the understanding of operational challenges through interviews is quite shallow. There is also an issue of trust that limits the amount of information an analyst shares with an interviewing researcher. In our work, we take an anthropological approach to address this problem. Students with Computer Science background get trained in anthropological methods by an anthropologist and are embedded as security analysts in operation centers. Embedded students perform the same job as an analyst and see the operational world from the view point of an analyst. Through reflection on the observations made by the students we gain a holistic perspective of the challenges in operation centers. In this paper we report preliminary results on the ongoing fieldwork at two corporate and a University SOC.

Patterns, which are based on in-depth practical experience, can be instructing for the design of groupware applications as sociotechnical systems. On the basis of a summary of the concept of patterns -as elaborated by the architect Christopher Alexander -its adoptions within computer science are retraced and relationships to the area of groupware are described. General principles for patterns within this domain are formulated and supported by examples from a wide range of experience with knowledge management systems. The analysis reveals that every pattern of a groupware application has to combine the description of social as well as technical structures, and that a single pattern can only be understood in the context of a pattern language. It also shows that such a language has to integrate patterns of socio-technical solutions with measures and procedures for introducing them, and that the language not only has to express one type of directed relationship between the patterns but a variety of different types which have to be deliberately assigned to the patterns.

Empirical studies on workflow usually focus on systems which have already been introduced and on the problems which occur with these systems if exceptional cases differ from the regular business processes. This study focuses on the problems that occur in the early stages of projects intended to introduce workflow systems but which do not inevitably succeed. In most cases the companies under investigation eventually introduced other types of software, or the business processes were merely analysed and improved but not automated during the project. We explain this phenomenon by referring to Orlikowski's concept of metamorphoses which analysed organizational change under conditions of groupware usage. A number of empirical details in our study of seven companies during a 4-year period can be related to this concept as well as to literature on workflow. In our ex-post study of the workflow projects we concluded that paradoxically starting with a workflow project might be an appropriate way of introducing improvement in cooperation and coordination without using workflow management technology and that concepts for flexible workflow technology are of minor relevance for this improvement.

Knowledge Management Software must be embedded in processes of knowledge workers' everyday practice. In order to attain a seamless design, regarding the special qualities and requirements of knowledge work, detailed studies of the existing work processes and analysis of the used knowledge are necessary. Participation of the knowledge owners and future users is an important factor for success of knowledge management systems. In this paper we describe characteristics of knowledge work motivating the usage of participatory design techniques. We suggest a design process for developing or improving knowledge management, which includes ethnographic surveys, user participation in cyclic improvement, scenario based design, and the use of multiple design artifacts and documents. Finally we explain the benefits of our approach. The paper is based on a case study we carried out to design and introduce a knowledge management system in a training company.