LDR 551_Book 5 Flashcards
What is the title of the paper by Sundaramurthy, Sathya Chandran, et al.?
A Human Capital Model for Mitigating Security Analyst Burnout
What method did researchers use to study SOC analyst burnout?
Anthropological study
What is the main conclusion of the study on SOC burnout?
Burnout is a human capital management problem
What did the researchers identify as connecting factors affecting analyst morale?
Multiple vicious cycles
What is the core model developed by the researchers called?
Human capital model for mitigating security analyst burnout
What are the four factors in the SOC human capital model?
Growth, Skills, Empowerment, Creativity
What happens if one factor in the SOC human capital model trends negatively?
Leads to a vicious cycle
What is the key driver of growth in the SOC human capital model?
Variety in job tasks
What should be used to eliminate mundane work in SOCs?
Automation
How are skills defined in the SOC human capital model?
Development and continuous improvement of analysts’ skill-set
What can cause analysts to look externally for new opportunities?
Skills no longer growing
Sources of WSO Training
On-the-job experiences, peer-directed, formal training
Purpose of on-the-job training
Honing skills through daily experiences
Examples of on-the-job training
Tabletop exercises, Purple Team exercises, penetration testing, Red Teaming
Key driver of analyst empowerment
Trust in SOC skills
Definition of empowerment
Analysts can do their job efficiently
Common problems in empowerment
New teams, politics, past mistakes
Recommended action for empowerment
Slowly build trust with peer-reviewed process
Definition of creativity
Ability to handle novel operational scenarios
Key driver of creativity
Empowerment to solve challenges uniquely
Common problems in creativity
Over-prescribed procedures, lack of time
Recommended action for creativity
Free time for improvements, encourage learning
Purpose of reflection in SOC
Review procedures to find bottlenecks
Purpose of automation in SOC
Eliminate repetitive tasks, improve efficiency
Tools for operational efficiency
SOAR, EDR, SIEM, scripts
What is the goal of finding repetitive tasks?
To automate tasks using scripts, SIEM, EDR, or SOAR.
How does automation affect analysts’ morale and creativity?
Improves morale and provides a creative outlet.
What happens when analysts develop new automated tasks?
Their job becomes easier.
What is the bi-directional connection noted by researchers?
Operational efficiency and job satisfaction.
How does human capital affect operational efficiency?
Skilled analysts make operations efficient.
How does automation impact operations?
Accelerates operations, especially repetitive tasks.
What influence does operational efficiency have on analysts?
Creates a positive influence.
Why are metrics crucial for SOC?
Communicate SOC’s value and ROI to management.
What can happen if bad metrics are used?
Can create falsely low perception.
How does improved operational efficiency affect metrics?
Improves consistency and shortens response times.
What happens when SOC perception improves?
Budget stays flowing or increases.
What is the most important feedback loop for SOC?
Management support fed by SOC metrics.
What was hard to define according to researchers?
Good, representative, operational metrics.
When are analysts more receptive to feedback?
When they believe in the metrics.
What should metrics show besides incident data?
Meaningful effort by the SOC.
What is the negative effect of bad metrics?
Masks problems and leads to negative consequences.
What can result from analysts being overburdened?
Burnout due to overwork.
What is a focus area for new analysts to prevent burnout?
Growth and skills development.
What should be the biggest focus areas for new analysts?
Growth and skills
What happens if new analysts max out their capabilities quickly?
They won’t stay long
How should new analysts’ learning be paced?
As fast as they can handle
When should new tasks be added for new analysts?
As soon as they master current tasks
What indicates it’s time to push new analysts toward new tasks?
When they look bored or “cherry pick” alerts
What types of training should be provided to new analysts?
On-the-job, peer-led, and formal training
What is the goal of the training for new analysts?
To reach tier 2 level quickly
What should never happen to experienced analysts?
Finding the “ceiling” of learning
What should be provided if no one is left to train experienced analysts?
Additional outside training
How can creativity help experienced analysts?
By creating new and difficult challenges
What should experienced analysts be given to leverage their skills?
Vague descriptions and autonomy
What should be done to leverage experienced analysts’ power?
Assign new tools, automation, improvements
How should tasks be geared for optimal growth?
Toward the edge of their capabilities
What state do tasks at the edge of capabilities induce?
Flow state
What is essential for understanding employees’ capabilities?
Regular one-on-one meetings
What is “Deep Work”?
Distraction-free concentration pushing cognitive limits
What has exponentially increased in corporate communications over the last few decades?
Email communications
What has replaced or augmented email in recent years for real-time communication?
Slack, Teams, and other chat platforms
What problem do new collaboration tools introduce despite addressing email issues?
Interrupting deep work
How often do employees who use Slack check their channels on average?
Once every five minutes
What is a significant challenge in a dynamic SOC environment?
Maintaining focus while context-switching
What do neuroscientists and psychologists say about our attention?
It is fundamentally single-tasked
What must be given to minimize burnout and keep people in their “flow channel”?
Time and space for deep work
What is the goal in promoting deep work?
Reduce or eliminate shallow work
What percentage of time did a SOC team spend on shallow work in a recent consulting engagement?
About 70%
What should SOC tools and processes promote?
Deep work by leaving room for focus
What model is useful for understanding human behavior in performance management?
Thomas Gilbert’s Behavior Engineering Model (BEM)
What should managers consider when an employee is not meeting expectations?
Both environment and individual motivations
What are the three external factors in the BEM?
Data, Resources, Incentives
What are the three internal factors in the BEM?
Knowledge, Capacity, Motives
What is crucial for staff retention and burnout mitigation?
Optimize for growth, skills, empowerment, and creativity
What is beneficial for both the organization and team mental health?
Good organizational practices
What can prevent people who enjoy their work from having a bad experience?
Effective techniques
What can help save good talent if employees aren’t interested in their job?
Job rotations to other groups
What can minimize factors that influence burnout?
Commitment
What is culture according to Ben Horowitz?
How your team makes decisions when you’re not there
What should you do to build the SOC culture you want?
Know yourself and your limitations
What should you provide to encourage desired behaviors and decisions?
Constructive feedback
What is the first step in building a better team culture?
Define and communicate your values
What should you gather to ensure your culture is moving in the right direction?
Metrics like turnover and retention rates
What can higher-than-usual turnover indicate?
You may have a culture problem.
What should you be open to from your team to build trust?
Criticism and feedback.
What should you examine in the context of team values?
Your own mistakes.
What is building a positive culture described as?
An iterative process.
What is culture compared to in its cyclical nature?
Human capital.
What are signs you have a culture problem?
High turnover, failing priorities, shocking actions.
Who are the possible culture-breaking personality types?
The Heretic, The Flake, The Jerk, The Prophet of Rage.
What might indicate a culture problem despite good processes and people?
Team not operating at a high level.
What are signs your team may be off track?
High turnover, low satisfaction, shocking actions.
What should you do if a team member surprises you with bad behavior?
Investigate whether it’s an aberration or pattern.
What might you need to do with disruptive team members?
Identify and take action.
What are common failures in building a positive team culture?
Not correcting behaviors, negative incentives, poor communication.
What is a manager’s job in terms of team expectations?
Manage expectations and highlight risks.