Security Operations Center: A Systematic Study and Open Challenges

Vielberth, Manfred; Böhm, Fabian; Fichtinger, Ines; Pernul, Günther

doi:10.1109/access.2020.3045514

Cited by 103 publications

(69 citation statements)

References 165 publications

(352 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Although processes and technology are integral to a SOC's function, people are the most critical element as it is extremely difficult to technologically emulate human thought processes for analyzing and remediating threats [1], [3]. Vielberth, Böhm, Fichtinger, and Pernul state that, although automation technologies are necessary for SOC operations, automation is difficult to implement and only works under the correct conditions which leads to the conclusion that "Determining whether an alert is real requires further investigation by the analysts based on tacit knowledge" [8].…”

Section: Soc Foundational Elementsmentioning

confidence: 99%

Security Operations Centers: A Holistic View on Problems and Solutions

Shutock¹,

Dietrich²

2022

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Since Security Operations Centers (SOCs) were first implemented, they have strived to protect the organization and constituency they serve from all manner of Information Technology (IT) security threats. As SOCs have evolved over time to become as effective and efficient at this as possible, they have struggled with changes and upgrades to their foundational elements of people, processes, and technology in pursuit of this mission. While most relevant literature focuses on one challenge a SOC faces, or one aspect of one problem, the authors of this paper performed a literature review to identify and discuss the top current and future challenges that SOCs face in addition to the top current and future solutions to these problems.

show abstract

Section: Soc Foundational Elementsmentioning

confidence: 99%

Security Operations Centers: A Holistic View on Problems and Solutions

Shutock¹,

Dietrich²

2022

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

show abstract

“…Many studies have been conducted regarding cyber security threats, attacks, incident response, mitigation procedures and how to defend cyber-attacks. Security Operation Centre (SOC) teams represent the first line of defence as they are anticipated to detect threats and escalate them to Incident response (IR) teams [8] . Although many researches highlighted SOC, many of them had lacked a thorough overview of the challenges that might face SOC teams as observed from [9,10] .…”

Section: Literature Reviewmentioning

confidence: 99%

“…Key Performance Indicator (KPI), Key Risk Indicator (KRI) used to indicate how risky an activity is, Key Change Indicator (KCI) used to understand the effectiveness of risk controls and actions taken to mitigate the impacts emerging from risks [8] . These metrics acknowledge strategic and operational improvements by providing analytical basis for decision making.…”

Section: Missing Kpi and Sla Measurementsmentioning

confidence: 99%

Cyber Security Professionals’ Challenges: A Proposed Integrated Platform Solution

Elradi

Abdelmaged

Mohammad

2021

electr. sci. & eng.

View full text Add to dashboard Cite

As cyber threats and attacks are immensely increasing and broadly spreading catastrophically worldwide, cyber security professionals need to cope up with such a highly demanding environment. Security teams, such as Security operation Centre (SOC), Incident Response (IR) and Threat management teams are the people responsible for dealing with cyber security threats and attacks from detection to containment and preventing future incidents; which encompasses some significant challenges that might impose some limitations to the efficiency and effectiveness of activities cyber security professionals conduct, as these processes are time-consuming. In this paper we propose an integrated platform to help cyber security professionals to proactively manage cyber security threats and emerging incidents by providing an automated functionality that can optimize the workflow. The proposed security platform is supposed to diminish the average time taken by cyber security professionals to respond to cyber incidents with an average of 42%. This study can be used as a preliminary design for such an integrated platform.

show abstract

“…In cybersecurity, the Security Operations Center (SOC) personnel faces vast amounts of data coming from a variety of sources, accumulated at rapid speeds. The constant flow of information often overwhelms the analysts, making timely and adequate response and mitigation unsustainable [ 4 , 5 , 6 ]. The so-called data triage automation is a well-known problem of SOCs [ 7 ], with the intensity of the domain and the characteristics of incident detection signals strongly degrading human performance [ 8 ].…”

Section: Introductionmentioning

confidence: 99%

A Systematic Review of Recommender Systems and Their Applications in Cybersecurity

Pawlicka

Pawlicki

Kozik

et al. 2021

Sensors

View full text Add to dashboard Cite

This paper discusses the valuable role recommender systems may play in cybersecurity. First, a comprehensive presentation of recommender system types is presented, as well as their advantages and disadvantages, possible applications and security concerns. Then, the paper collects and presents the state of the art concerning the use of recommender systems in cybersecurity; both the existing solutions and future ideas are presented. The contribution of this paper is two-fold: to date, to the best of our knowledge, there has been no work collecting the applications of recommenders for cybersecurity. Moreover, this paper attempts to complete a comprehensive survey of recommender types, after noticing that other works usually mention two–three types at once and neglect the others.

show abstract

Security Operations Center: A Systematic Study and Open Challenges

Cited by 103 publications

References 165 publications

Security Operations Centers: A Holistic View on Problems and Solutions

Security Operations Centers: A Holistic View on Problems and Solutions

Cyber Security Professionals’ Challenges: A Proposed Integrated Platform Solution

A Systematic Review of Recommender Systems and Their Applications in Cybersecurity

Contact Info

Product

Resources

About