The main trend relating to state structures and large corporations is to build Information Security Monitoring Centers the key elements of which being SIEM-systems and SOC-Centers. Speaking about SOC-Centers the task of human resources optimal allocation among information security incident reporting lines taking into consideration staff competency and line capacity seems to be urgent. This task is solved in the article given. In general, the formulation of the task presented means the functioning of SOC-Center as a new mathematical model making use of “input - resources - output” terms. The target function of SOC-Center is built in an assumption of stationarity and independency of service reporting lines as a sum of their target functions. The main idea of human resources management in this case is the aspiration to achieve maximum significance of SOC-Center system aim, i.e. its general target function when organizing the fight with computer attacks. The problem was solved by Lagrange multiplier method. The expressions for optimal allocation of human resources on SOC-center service lines leading to maximum processing of message flow related to computer attacks have been received. The conclusion about this model being useful for transferring from stationary flows to their dynamic changes in SOC-Center resource provision including new different critical situations in computer system has been made.
Modern state structures being referred as critical ones as well as geographically distributed intersectoral and large industrial corporations form complex Information Security Monitoring Centers (ISMC) [1-3]. The structural elements of these Centers are represented as the devices to collect incidents arising in external and internal sources (user devices, network devices, different systems of information defense, web-services, etc.) Primary monitoring segment of ISMC is SIEM – systems. SIEM (Security Information and Event Management) technology presupposes automated real-time analysis of security events in network devices and applications. The next segment of monitoring, processing and reaction to information security incidents in ISMC is SOC – center (Security Operation Center) that receives notifications about threats from SIEM – system where operators being qualified employees in the sphere of information security make decisions concerning the reports about threats. Mathematical modeling of SIEM – system and SOC – center functioning processes is of utmost importance to improve the control of information security in organizations [2, 3]. This fact is caused by the necessity to create scientific apparatus allowing to efficiently solve the problems connected with optimal ISMC resources control, with evaluation, analysis and forecasting of computer attacks, etc. The article given considers the model to optimize SOC-center human resources allocation on information security incident reporting lines taking into consideration staff competence and line capacity.
The formulation of management task is as follows.
Let there be a certain multitude of problems to respond on information security incidents, for them to be solved SOC-center needs to have a certain amount of human resources. Human resources need to be optimally allocated among service levels (decision making levels) taking into account a number of limitations.
ISMC material and technical resources can be considered in this case as the tools increasing the realization opportunities of the staff that play the leading role in the process of problem solution. Particularly, different level of logistics in corresponding mathematical models is seen in different parameters reflecting the efficiency in staff activity of SOC-center that provides the services on computer attacks incident reporting lines.
Further let us designate the flow of input reports about computer incidents as input vector ⃗, the result of report processing in SOC-center – as output vector ⃗, ⃗ designates the vector of human resources being competent in decision making referring to computer incidents. General form in the dependence of output variables vector from input variables vector as well as human resources vector is as follows:
⃗ = ( ⃗, ⃗) , (
By analogy with production processes described in the
applications of the theory of active systems [4-6] we shall
name the functional connection between acceptable level
of resource costs and input vector, on the one hand, and
output variable extreme values (minimum and maximum)
corresponding to them – on the other hand, as production
or target function:
(
Two main approaches to build target functions – statistic and optimization – can be mentioned [7, 8]. The first one is based on statistics dependency recovery. The second approach is based on generalizing the solutions of tasks analogous to the ones in other areas as well as theoretical speculations and assumptions.
The article presented follows the second approach
where mathematical model “costs – results” is given by
introducing target function of the following type:
(
We shall assume that function (
The choice of the function being type (
The diagram shows that all reports about computer attacks entering the first and the second SOC – Center lines are subdivided into three categories regarding to which the staff makes one of three decisions: first – the ones representing no threat for computer system ( ); = 1,2,3; second – repulsed attacks ( ); = 1,2,3; third - the ones transferred to a more competent and higher level of decision making ( ); = 1, 2, 3. The third line, the one where the most competent employees work is supposed to transfer the reports with no decisions being made to a special database in the form of 3 flow for further in-depth examination.
We shall assume that in a certain period of time a stationary mode of processing computer attack reports is seen. Then for three SOC – Center lines the following nine equations are satisfied: 1= 1 ·=[1 −1+e xp1(+− 11 · 1)] 1= 1 · [1 − exp(− 1 · 1)]
1 = 2 + 2 + 2
2= 2 · [1 − exp(− 2 · 12)] (
· 2 )] 3= 3 · [1 − exp(− 3 3 3= 3 · [1 − exp(− 3 · 23)], where AY1, AQ1; AY2, AQ2; AY3, AQ3 - constants, characterizing flow asymptotes that reflect the number of reports received by line operators having no threats to computer systems and the number of repulsed attacks correspondingly. In their turn, 1, 1; 2 , 2 ; 3, 3 – are the coefficients that reflect competency and professionalism of employees working on 1st, 2nd, and 3rd SOC lines to process computer attack reports, correspondingly. Here, the higher the service line, the higher the competence.
The following notations for loads in i-th line of SOC – center are introduced:
ℎ1 = 1 ; ℎ2 = 12; ℎ3 = 23 (
1 = 2 + 2 + 2 2= 2 · [1 − 1 + 2 · ℎ2] 2= 2 · [1 − 1 + 2 · ℎ2]
2 = 3 + 3 + 3
3= 3 · [1 − 1 + 3 · ℎ3]
3= 3 · [1 − 1 + 3 · ℎ3]
Simplifying (
=3 ∑ =1
+ · 12 + · 23 − · (∑ ==31 − 0). (22)
We shall believe that in case of stationary mode expression (22) is found from ratios: , 1 и 2 – are constant, then conditional extremum of ( , )
( , ) =
= 0; i = 1, 2, 3. (23)
Having done differentiation we come to the system of
equations:
1 + 1 = · ℎ1
2 + 2 = · ℎ2,
= 2 · 2 + 2 · 2 ,
3 + 3 = · ℎ3,
= 3 · 3 + 3 · 3
(
1 ( , )
2 ( , ) 3 ( , ) = − · 12 − = 0 122 − = 0 2 32 − = 0 =
− = 0 = − · = − · =3 =1 =3 =1
=
12 = · 122 = · 232
Equations (25) can easily give expressions for such human resources allocation on SOC – Center reporting lines that lead to the maximum processing of computer attack incident report flow on computing system of the organization. Namely:
= 1 · 1 + 1 · 1 , 2 · 1 − .
3
Besides, making use of ratios (
Besides, (28) leads to inequality fairness: 0 < < 1; 0 < < 2 ; 0 <
< 3 . 3 < 2 < 1 < (29)
Taking into consideration the dependences of flows from human resources allocation on reporting lines ; = 1,2,3, a recursive algorithm to find optimal solution has been developed. To justify the values of model parameters, initial conditions and
asymptotic values the results received in works [11-15] have been applied in the system to counteract computer attacks.
˗ ˗ ˗ ˗
The model of SCO – center operation being developed in the article under consideration have allowed us to describe the system of multilevel computer attack reporting service taking into account competency of employees and capacity of the channels that react to information security incidents. Formalization of the processes that react to reports about incidents in the model justified and implemented by the authors allows studying: efficiency of different allocations in human resources being at SOC – Center disposal to fight with computer attacks, viz., to find the allocation with maximum result in the course of processing the reports about threats to computing resources and cutting off real threats from them; influence
of such factors as competency and professionalism of SOC –
Center employees in different service reporting lines on suppression of computer attacks; errors of first and second order in each reporting line; possibilities to justify and transfer from stationary flows in the model to their dynamic changes including different critical situations of SOC – Center resource provision.
The work has been implemented and published with the RFBR support, grant 19-07-00445. management processes of information security //