Supporting Intrusion Detection Work Practice
John R. Goodall, Wayne G. Lutters, Anita Komlódi · Journal of information system security · 2009
In an increasingly networked world, information security is an increasingly important domain, but one that is not well understood. Yet, an understanding of how this work is accomplished is crucial to designing tools and management policies to better support it. The work practice of intrusion detection analysts is a complex fusion of individual and collaborative resource monitoring and problem solving. This paper details the practice of intrusion detection work, specifically highlighting the tasks that make up the work, and it concludes with a discussion of the implications that this work understanding has on future design of tools and organizational policies to make intrusion detection work more efficient