Toss If Perishable: An Ethnographic Study on Building Scenario-Based Training for Non-Perishable Skills
University study of 25 trainees tests tool-agnostic SOC scenarios meant to teach durable investigative reasoning.
The authors define non-perishable knowledge as investigative reasoning that does not depend on a SOC's particular tools or procedures. They designed two tool-agnostic incident scenarios from real-world cases and studied how university trainees performed. Data came from about 20 hours of training with 25 trainees across five sessions. Grounded-theory analysis identified factors that inhibit or promote learning of investigative thinking skills considered important in security operations centers.
- Non-perishable knowledge is investigative thinking independent of SOC tools.
- Two training scenarios were based on real-world incidents.
- Twenty-five trainees completed about 20 hours across five sessions.
- Grounded theory identified factors that help or hinder learning.
Full article187 words · extracted from arxiv.org · click to collapse
Security Operations Centers (SOCs) often rely upon on-the-job training focusing on the specific tools and procedures a SOC utilizes. The complexity in tooling can overshadow the underlying reasoning process, hindering an analyst's ability to learn investigative skills. We formulate the concept of "non-perishable knowledge" which corresponds to investigative thinking skills independent of tools. We developed a scenario-driven training method to understand whether such non-perishable knowledge can be imparted through specially designed incident scenarios, where trainees are presented with and solve investigative challenges in a tool-agnostic manner. We designed two such scenarios based on real-world incidents. Human subjects were recruited from a university's student body for ethnographic study to understand how this training method is received by the subjects and how they perform on such tasks. We collected data from 20 hours of documented training with 25 trainees spread across five sessions. Using grounded-theory, we analyzed the data and uncovered factors that inhibit or promote learning of the investigative thinking skills. Our research combines scenario-based training, ethnographic research, and technical analysis to examine how to best train students in the reasoning skills that industry deems vital to SOCs.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21147