From Cyber Security Activities to Collaborative Virtual Environments Practices Through the 3D CyberCOP Platform

Abstract

Although collaborative practices between cyber organizations are well documented, managing activities within these organizations is still challenging as cyber operators tasks are very demanding and usually done individually. As human factors studies in cyber environments are still difficult to perform, tools and collaborative practices are evolving slowly and training is always required to increase teamwork efficiency. Contrary to other research fields, cyber security is not harnessing yet the capabilities of Collaborative Virtual Environments (CVE) which can be used both for immersive and interactive data visualization and serious gaming for training. In order to tackle cyber security teamwork issues, we propose a 3D CVE called the 3D Cyber Common Operational Picture, which aims at taking advantage of CVE practices to enhance cyber collaborative activities. Based on four Security Operations Centers (SOCs) visits we have made in different organizations, we have designed a cyber collaborative activity model which has been used as a reference to design our 3D CyberCOP platform features, such as asymetrical collaboration, mutual awareness and roles specialization. Our approach can be adapted to several use cases, and we are currently developing a cyber incident analysis scenario based on an event-driven architecture, as a proof of concept.

Security Operations Center: A Systematic Study and Open Challenges

“…Roles & Responsibilities [8], [14], [46], [54], [66], [79]- [81] Recruitment & Retention [10], [15], [32], [82]- [93] Training & Awareness [14], [88], [89], [93]- [96] Collaboration & Communication [8], [11], [12], [17], [23], [47], [97]- [99] be more specific when the SOC grows. For example, in a small SOC with only a few analysts, everyone needs to be knowledgeable on several skills because a few employees need to cover all the arising tasks.…”

“…An upcoming trend is the operative use of visualization platforms with collaboration features, e.g., the 3D Cyber-COP platform [12], [99] distinguishes explicit collaboration through the platform and implicit collaboration through oral communication and logging every user's actions. It is imperative for the SOC team's success to have constant interaction and communication with other business units, for example, the help desk, network administrators, or even the legal team.…”

“…Data Collection [37], [47], [80], [103], [104], [107], [111], [127]- [132] Analysis & Detection [13], [35], [41], [43], [55], [56], [84], [133]- [157] Presentation [9], [12], [13], [80], [97], [99], [112], [127], [158]- [170] V-B2). As the interface between people and machines, the presentation of data and analysis results is of particular interest in a SOC context.…”

“…The Situ platform [13] has the goal to visualize the context of an incident for leveraging the experience of security experts. In contrast to the approaches described above, the CyberCOP [12], [99], [160] platform relies on three-dimensional visualization. The VISNU project [112], [161], [162] takes a similar approach, which improves the collaboration of multiple SOCs in different organizations by displaying network data in three dimensions.…”

Threat Hunting basado en técnicas de Inteligencia Artificial

“…A parte de las visualizaciones simples, también se pueden encontrar las visualizaciones complejas. Las hay de muchos tipos, como por ejemplo, aquellas orientadas a detección de patrones [12,39,119,133,281]. Asimismo, también existen visualizaciones centradas en geoposicionamiento, ya sea para activos [39,133,157], riesgos [36,170,199] y amenazas [39,157].…”