Human performance measures for cyber security operations centers

Abstract

Human performance metrics and measures are important to Security Operations Centers (SOCs). Metrics are used by SOC managers to assess analysts’ performance. However, existing metrics for analysts tend to focus solely on task performance. Researchers and practitioners may value ideas on other dimensions by which the performance of an analyst can be measured. As studies on performance metrics for analysts continue to evolve, this paper provides timely insights and recommendations for researchers and practitioners on different dimensions by which the performance of an analyst can be measured. This paper identifies and presents various dimensions by which analysts’ performance could be measured. Beyond the identification of the different dimensions, this paper provides examples of measurable constructs under each suggested dimension in the context of a SOC.