An Outsourcing Model for Alert Analysis in a Cybersecurity Operations Center
Abstract
A typical Cybersecurity Operations Center (CSOC) is a service organization. It hires and trains analysts, whose task is to perform analysis of alerts that were generated while monitoring the client’s networks. Due to ever-increasing financial and infrastructure burden on a CSOC driven by the rapidly growing demand for security services, it would become prohibitively expensive to continually expand the size of a CSOC to meet the demands in the future. An alternative solution is to outsource the alert analysis process to on-demand analysts, to provide scalable CSOC service to its clients with features, such as (1) higher throughput, (2) higher quality, and (3) more economical service than the current in-house service. The current outsourcing model is not cost effective and an exact optimization model is computationally inefficient. This article presents a novel two-step sequential mixed integer programming optimization method that is used in the development of a new decision-support business model for outsourcing the alert analysis process. It is demonstrated that through this model, a CSOC can effectively deliver its alert management services with the above-mentioned features. Results indicate that the model is scalable, computationally viable, real-time implementable, and can deliver CSOC services that meet the service-level agreement (SLA) between the CSOC and its client. In addition, the article provides valuable insights into the cost of operating the new business process outsourcing model for cybersecurity services.
Document Details
- Document Type
- Pub Defense Publication
- Publication Date
- Jan 09, 2020
- Source ID
- 10.1145/3372498
Entities
People
- Ankit Shah
- Hasan Çam
- Rajesh Ganesan
- Sushil Jajodia
Organizations
- Army Research Office
- George Mason University
- National Science Foundation
- Office of Naval Research
- United States Army Research Laboratory
- University of South Florida