The Human Factor Capabilities in Security Operation Center (SOC)

Abstract

AbstractThe need for Cybersecurity Operation Center to protect the information system against cyberattacks has become increasingly common and a must to face the new sophisticated and advanced threat. The socio-technical system of the SOC contains three building blocks Human resources, technologies, processes. The literature review, announcements, and publications of the cybersecurity industry reveal that the human factor is considered the weakest link in cybersecurity and inside the Security Operation Centers (SOC). It represents the most important factor to guarantee the best performance. Many researchers shed light on the human factor challenges inside the SOC environment and how these challenges could be addressed, reduced or mitigated. However, these research papers do not consider the complexity, unpredictability and interdependent and evolving nature of the SOC systems.This study aims to explore the human challenges inside the complex and interdependent socio-technical SOC system. To this end, we employed survey-based questionaries with 40 SOC analysts and 5 experts alongside the daily observation of SOC analysts and interviews with SOC experts. The finding of this study will help SOC managers and SOC designers better understand the challenges faced by the SOC analysts and take into account the interdependent and evolving nature of the Security Operation Centers.KeywordsHuman factorsSecurity Operation CenterWeaknessChallenges