Next Generation Security Operator Training Infrastructure

ongoing

While the fostering of Security Operation Center (SOC) creations is advancing full steam by the creation of toolsets, the procurement of data feeds, and artificial intelligence, this proposal focuses on the human aspect of a SOC. Despite today a lot of potential operators are already there lacking good tool-sets or data feeds, this proposal looks a head towards a new generation of SOC operators. These SOC operators will be confronted with new challenges such as adversarial machine learning attacks as a consequence of heavy use of Artificial Intelligence in SOC environments. Currently SOC operators are either emerging from an IT career via lateral movement from other teams such as system administrators or software developers. An alternative path to end up in a SOC is through an academic curriculum, offered by university. These curricula were established by researchers with teaching capacities. However, the content is strongly based on the experiences of the teachers. A complementary used technique is to use guest lecturers from leading industry to refresh the curricula. Once in the SOC, the operators have to be trained to the new challenges. A common strongly expanding technique is the use of cyber ranges defined by academia and operated by commercial operators. These cyber ranges are driven by playbooks. Albeit there are efforts to generate these laybooks for real data, they do not replace a real SOC with real data. Hence, in this proposal is described the establishment of a real operational infrastructure used to train next generation SOC operators. This infrastructure will be jointly operated by CIRCL, hosting the infrastructure and Restena providing the network interconnectivity.The teaching and training activities will be done jointly in the educational sector.