Capturing Tacit Knowledge in Security Operation Centers

Abstract

The use of tacit knowledge has previously been shown to help expedite problem-solving procedures in the setting of medical emergency responses, as individuals can use past experiences in present and future challenges. However, there is a lack of understanding in its application in IT and socio-technical management. This paper examines the thought processes observed in Security Operational Centre (SOC) analysts facing threat events to lay the groundwork for tacit knowledge management in SOCs. Based on Sternberg's fieldwork in tacit knowledge, we conducted semi-structured interviews with ten analysts to explore the key artefacts and individual traits that aid their approach to communication, and to examine the thought processes under hypothetical incident handling scenarios. The results highlight a unanimous pursuit of Root Cause Analysis (RCA) upon the outbreak of an incident and stages of decision-making when escalating to third party support providers. Using Business Process Modelling and Notation (BPMN), we show the procedural elements of tacit knowledge from several scenarios. The results also suggest that simulation environments and physical proximity with analysts and vendors can facilitate the transfer of tacit knowledge more effectively in SOCs.

Creating Meaningful Intelligence for Decision-Making by Modelling Complexities of Human Influence: Review and Position

“…The excessive focus on rationality not only does omit important repercussions of decisions, but it is also undesirable, as it can become an obstacle to strategy implementation [88]. Capturing tacit knowledge is a possible way to feed future decision-models with meaningful information [89].…”

Security Operations Center: A Systematic Study and Open Challenges

“…Preparation [22], [55], [67], [103]- [113] Detection & Analysis [4], [67], [80], [83], [114]- [118] Containment, Eradication & Recovery [80], [83], [97], [103], [104], [114], [117]- [122] operations. Since the goal of a SOC is to respond to or prepare for incidents, one way to structure the underlying processes is through the Incident Response Lifecycle [103], [114], [119], [120] or similar frameworks such as presented in ISO/IEC 27035:2016 [123]. According to the NIST Computer Security Incident Handling Guide [124], the Incident Response Lifecycle comprises the four steps "preparation", "detection and analysis", "containment, eradication and recovery" and "Post-incident activity", which also form the structure of the following chapter.…”

“…The reason for this could be that employees know which tasks they have to carry out, but this has not been specified explicitly, which can cause problems, e.g., when staff changes. Therefore, Cho et al [119] conducted a study where they show how it is possible to capture SOC staff's tacit knowledge on how they perform their tasks as processes.…”

The Use of Knowledge Management-Based Information Collaborative Learning Tool in English Teaching Classroom

“…It is possible to submit assignments and take quizzes via Facebook, email, and other web-based tools and technologies, including Skype and live chat, as well as video conferencing. One of the essential parts of increasing literacy in an EL setting to achieve economic growth is the application of knowledge [11]. Cooperative exchange of knowledge can be achieved through online discussion forums, in-person lectures, or mashups.…”