What You Can Change and What You Can’t: Human Experience in Computer Network Defenses

Security Operations Center: A Systematic Study and Open Challenges

“…Roles & Responsibilities [8], [14], [46], [54], [66], [79]- [81] Recruitment & Retention [10], [15], [32], [82]- [93] Training & Awareness [14], [88], [89], [93]- [96] Collaboration & Communication [8], [11], [12], [17], [23], [47], [97]- [99] be more specific when the SOC grows. For example, in a small SOC with only a few analysts, everyone needs to be knowledgeable on several skills because a few employees need to cover all the arising tasks.…”

Social Constructionism in Security Protocols

“…The exchange of threat information within sharing communities is a recommended practice for individuals working in Computer Network Defence, such as Security Operations Centres (SOCs) and Computer Security Incident Response Teams (CSIRTs). Studies report that effective information sharing and collective problem solving are required for a successful security incident response [1,[18][19][20]. There are risks when sharing communities span multiple organizations and it is important that sensitive information about threats, their remediation and legal and organizational requirements are safeguarded.…”

“…The transcribed interviews were analysed using Grounded Theory techniques, such as line by line coding, the development of categories and themes, and memo writing. The theoretical analysis resulted in five themes [19].…”

“…In [19] we proposed that Social Identity Theory [21], Relational Dialectics Theory [3,4] and Cognitive Dissonance [9] could be used in order to shed light on how people make sense of their experience of Computer Network Defense work. The potential of Social Identity Theory is to provide all stakeholders with the means of understanding, for instance, the components, significance and means of establishing Social Identity in the context of individuals and teams engaged in Computer Network Defense.…”

“…Another phenomena that emerged from the research project concerned the manner of communication within the Security Operations Centre and Computer Security Incident Response Teams. We proposed [19] that this constructive and democratic way of communicating be incorporated into staff training, framing what is an emerging team activity by Relational Dialectics Theory [3]. Other aspects of experience that emerged in the research project centred around Areas of Tension, the fifth theme that was identified during data analysis.…”