Virtual reality for improving cyber situational awareness in security operations centers

Abstract

Security operations centers (SOCs) are the 911 centers of many organizational networks, except they not only respond, but also monitor. SOC operators are charged with detection, response, and mitigation. This is a tall task when one considers the volume, velocity, and variety of both internal and external organizational network and system data. SOC operations are truly a big data problem. Security orchestration, incident event management, data fusion, and anomaly detection systems help, but more is needed. This study examines the impact virtual reality (VR) can have on SOC operator performance and perceived task load. We developed a VR based network monitoring tool and assigned human subjects to one of three conditions – VR only, traditional tool only, or both. Our results, though small in scale, provide very promising indication that VR based technology may be beneficial for improving cyber situational awareness (SA), particularly with overall data perception involving novice SOC operators. The results are promising, but the sample size is small, so future research should validate this pilot study. Given the workforce challenges in the cybersecurity space, and the need to perceive large quantities of data, VR may be a very good addition to SOCs.