A Test Tool to Evaluate the Skill Sets of Tier-1 Security Analysts in a SOC Environment: A Case Study from Recruitment to Operations

Abstract

The skill set of tier-1 (T1) analysts have a great influence on the day-to-day operations of a Security Operation Center (SOC). Therefore, it is critical for a SOC to be able to evaluate the relevant skill sets of incoming analyst at recruitment and throughout their progress at the SOC. In this short paper, we identify from extant literature the relevant skills an analyst needs, and devise a test to evaluate those in collaboration with a commercial SOC. We conduct a case study of this test with three aspiring analysts at the collaborating SOC over a period of three months. Our case study shows that the test can be used to evaluate different skills of an analyst and can give insights at the SOC on analyst progress and training effectiveness, opening avenues for a full validation of the testing framework in future work. We discuss results, limitations, and future directions of this work.

Emmanuele Zambon

Assistant Professor

My research interests include Industrial Control System security and network intrusion detection.