A Tale of Three Security Operation Centers

Security researchers have been trying to understand func-tioning of a security operation center (SOC) and how se-curity analysts perform their job. This effort is motivated by the fact that security monitoring and analysis is not just a technical problem. Researchers must take into considera-tion the human and organizational factors for their research ideas to succeed. Much work towards this direction has been through interviews of security analysts in SOCs. Interviews, however useful, will not be always possible as analysts work in a high-stress and time constrained environment. Thus the understanding of operational challenges through interviews is quite shallow. There is also an issue of trust that limits the amount of information an analyst shares with an inter-viewing researcher. In our work, we take an anthropological approach to address this problem. Students with Computer Science background get trained in anthropological methods by an anthropologist and are embedded as security analysts in operation centers. Embedded students perform the same job as an analyst and see the operational world from the view point of an analyst. Through reflection on the observations made by the students we gain a holistic perspective of the challenges in operation centers. In this paper we report pre-liminary results on the ongoing fieldwork at two corporate and a University SOC