Enhancing Collaboration between Security Analysts in Security Operations Centers

Damien Crémilleux (1) , Christophe Bidan (1) , Frédéric Majorczyk (2, 1) , Nicolas Prigent (3)

1 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition
2 DGA.MI - DGA Maîtrise de l'information
3 LSTI

Security Operations Centers (SOCs) collect data related to the information systems they protect and process it to detect suspicious activities. In this paper we explain how a SOC is organized, we highlight the current limitations of SOCs and their consequences regarding the performance of the detection service. We propose a new collaboration process to enhance the cooperation between security analysts in order to quickly process security events and define a better workflow that enables them to efficiently exchange feedback. Finally, we design a prototype corresponding to this new model.

Domaines: Cryptographie et sécurité [cs.CR]

Damien Crémilleux, Christophe Bidan, Frédéric Majorczyk, Nicolas Prigent. Enhancing Collaboration between Security Analysts in Security Operations Centers. CRISIS 2018 - 13th International Conference on Risks and Security of Internet and Systems, Oct 2018, Arcachon, France. pp.1-6, ⟨10.1007/978-3-030-12143-3_12⟩. ⟨hal-01992346⟩