# How to Overcome Staff Shortage in Professionals for SOCs and NSICs

Natalia Miloslavskaya, Alexander Tolstoy

► To cite this version:

Natalia Miloslavskaya, Alexander Tolstoy. How to Overcome Staff Shortage in Professionals for SOCs and NSICs. 15th IFIP World Conference on Information Security Education (WISE), Jun 2022, Copenhagen, Denmark. pp.31-45, 10.1007/978-3-031-08172-9_3. hal-05311508

HAL Id: hal-05311508

https://inria.hal.science/hal-05311508v1

Submitted on 13 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# How to Overcome Staff Shortage in Professionals for SOCs and NSICs

Natalia Miloslavskaya(✉) and Alexander Tolstoy

The National Research Nuclear University MEPhI (Moscow Engineering Physics Institute),
31 Kashirskoye shosse, Moscow, Russia
{NGMiloslavskaya,AITolstoj}@mephi.ru

**Abstract.** The need for specialized training of professionals, currently of increased interest to Security Operations Centers (SOCs) and their evolutionary development unit Network Security Intelligence Centers (NSICs), designed to manage network security in the intranets of various organizations, is shown. The labor functions (LFs) of NSIC staff are defined. Following the documents of the Federal Service for Technical and Export Control (FSTEC) of Russia, the roles of the personnel of the centers of the State System for the Detection and Prevention of Computer Attacks (GosSOPKA) are presented. Basic general professional competencies (GPs) are formulated. As an example, the LFs and PCs are shown for the NSIC Head in detail. The MEPhI's readiness to implement a Master's degree programme for training personnel for NSICs is justified, based on the "Information Security and Business Continuity Maintenance" Master's degree programme being implemented at the MEPhI for the past 10 years.

**Keywords:** Professional · Network security · Network security management · Security Operations Center (SOC) · Network Security Intelligence Center (NSIC) · Academic training · Professional competencies · Knowledge · Skills · Discipline

## List of Abbreviations

<table><tr><td>AS</td><td>Automated System</td></tr><tr><td>CS&Ns</td><td>Computer Systems and Networks</td></tr><tr><td>FSES</td><td>Federal State Educational Standard</td></tr><tr><td>FSTEC</td><td>Federal Service for Technical and Export Control of Russia</td></tr><tr><td>GLFs</td><td>Generalized Labor Functions</td></tr><tr><td>GosSOPKA</td><td>State System for the Detection and Prevention of Computer Attacks</td></tr><tr><td>GPs</td><td>General Professional Competencies</td></tr><tr><td>HE</td><td>Higher Education</td></tr><tr><td>ICT</td><td>Information and Communication Technology</td></tr><tr><td>IP</td><td>Information Protection</td></tr><tr><td>IPT</td><td>Information Protection Tool</td></tr><tr><td>IPS</td><td>Information Protection System</td></tr><tr><td>IS</td><td>Information Security</td></tr></table>
<table><tr><td>ISM</td><td>Information Security Management</td></tr><tr><td>ISMS</td><td>Information Security Management System</td></tr><tr><td>ISMT</td><td>Information Security Maintenance Technologies</td></tr><tr><td>LFs</td><td>Labor Functions</td></tr><tr><td>NSIC</td><td>Network Security Intelligence Center</td></tr><tr><td>PCs</td><td>Professional Competencies</td></tr><tr><td>PS</td><td>Professional Standard</td></tr><tr><td>SIEM</td><td>Security Information and Event Management</td></tr><tr><td>SOC</td><td>Security Operations Center</td></tr><tr><td>TI</td><td>Threat Intelligence</td></tr></table>

# 1 Introduction

Currently, there is an annual increase in computer attacks in all spheres. Information security (IS) has become the subject not only of cybercriminals, but also of corporate games, and political and information wars. The key attack trends are overcoming a blurred network organizations' perimeter, social engineering, attacks through the supply chain, shadow markets for selling access, in-depth research of remote banking systems that includes the identification of vulnerabilities from mobile applications, theft of customer data, bypassing the control of debitting payments, and masquerading as legitimate activities. Among the features of modern cybercriminals, there are ample opportunities to prepare for a targeted attack, high secrecy, targeting the complete seizure of infrastructure, as well as tools for all occasions (0-day vulnerabilities, attack playbooks, and bypassing virtually any information protection tools (IPTs) of any vendor). The consequences of attacks are increasingly associated with the reputation, and not only with financial losses of a hacked organization. Therefore, protection against attacks becomes an integral part of ensuring the security of the management and business processes of any organization.

In every second speech at the SOC-Forum-2021, “The practice of countering cyber-attacks and the construction of IS monitoring centers”, held annually at the end of the year in Moscow, it was noted that there are not enough specialists who are responsible for ensuring security at enterprises. The shortage of personnel is estimated at 500,000–1,000,000 specialists. In particular, the Sberbank of Russia, from the point of view of its top management, needs about 20,000 specialists. As presented to the general public in 2005 [1], most of the understaffing is observed in the Security Operations Centers (SOCs) introduced by Cisco.

The SOC's experience allows us to highlight the following trend – on average its staff is completely updated over six years, which sets the task of finding new and developing existing employees [2]. Although outsourcing provides for saving on staff, the ability to attract highly qualified specialists, the advantages of your SOC with your staff and 24/7 monitoring are obvious, namely autonomy, complete control, and multi-vendor solutions used in the SOC. As an evolutionary development of CERT, within the organizations, the SOC becomes a center of competence in IS, where the staff knows exactly what to do in each specific situation and is ready to share knowledge and skills with colleagues.
In addition, experts highlight the problem of rapid staff burnout (a condition resulting from chronic stress at work), which previously occurred at the age of 40, and now occurs at a significantly younger age – as young as 25 years. It is an especial psychological state in healthy people, resulting from intense and emotionally loaded communication during professional activities (psychiatrist H. J. Freudenberg [3]). On 28 May 2019, the World Health Organization (WHO) included occupational burnout in the International Classification of Diseases (ICD 11). The reasons lie in staff shortage and the specifics of the work in SOCs, for example, the results of IS service usage are evaluated only by errors, people experience information overload, their work is characterized by monotony and routine and their activities are carried out in an organic workspace. It is a well-known fact that hackers are more advanced than defenders.

The situation is aggravated by the fact that the 20-year-old generation sees successful highly-paid TikTokers who earn more than IS specialists (an appropriate analysis is beyond the scope of this paper).

Another significant problem is the lack of professors capable of equipping their students with knowledge and skills in the area of SOCs. This could be solved by the broad involvement of practitioners from the IS industry (and again, an appropriate discussion goes beyond the scope of this page-limited paper).

Due to the rapid and often unpredictable development of information and communication technology (ICT) over three to five years, the need for appropriate IS specialists for ICT may likely change. Today it is clear that IS specialists require specialized knowledge and skills in big data analytics and practical usage of artificial intelligence to ensure IS. Modern ICT requires automated detection and forecasting of IS threats, and not only informed decision making and rapid response to these threats. The same applies to SOCs.

In 2010, the SOC concept was improved with the introduction of a Network Intelligence Center (SIC) concept. This concept sparked the authors' research, as a result of which the Network Security Intelligence Center (NSIC) was based on a combination of all the advantages of the SIC and Network Management Center (NOC) [4–6]. NSICs are the next step in SOCs' evolution.

However, this means that more highly qualified specialists are needed at present, and training for NSIC's developers and users is especially relevant. The study conducted by the authors showed that there is no specialized academic training of professionals for SOCs and the even newer concept of NSICs in any university anywhere in the world. The paper's contribution to solving this problem and the corresponding goal can be formulated as follows: to work out some initial proposals for developing a Master's degree programme for training personnel for SOCs and NSICs as one of the key ways to overcome staff shortages for these centers.

The rest of the paper is organized as follows. In Sect. 2, related work is briefly analyzed. The labor functions of NSIC staff are defined in Sect. 3. Following the documents of the Federal Service for Technical and Export Control (FSTEC) of Russia, the roles of the personnel of the centers of the State System for the Detection and Prevention of Computer Attacks (GosSOPKA) are presented in Sect. 4. Basic general professional competencies (GCs) are formulated for the tiers of NSIC personnel in Sect. 5. The MPhI's readiness to implement a Master's degree programme for training NSIC personnel is discussed in Sect. 6.
## 2 Related Work

Efforts to develop a unified view on the necessary volume of knowledge, skills, and abilities of IS specialists, which would include a necessary and sufficient set of requirements for graduates of higher educational institutions and students of advanced retraining courses of various educational institutions and centers that provide long-term and short-term training of specialists have been made for many years all over the world. The first attempts to form a unified point of view have been made at the World International Conferences on Information Security Education (WISE) between the late 1990s and early 2000s. Around the same time, certification systems for IS specialists at the initial and more advanced levels of various companies began to appear and were then expanded for new IT. However, to date, unified and globally recognized competencies of IS specialists have not been defined, although the American, Australian, and European training approaches have been formed (they are analyzed in [7] in detail).

During that time, several useful standards were adopted, for example, ISO/IEC 27021:2017 formulates competencies for specialists in IS management systems (ISMS) [8] (currently it is being revised for updating). They are described from the point of view of the labor functions (LFs) of an employee with specific knowledge and skills. These competencies are divided into two categories: 12 general competencies in the context of the organization's activities and 12 in ISM, including IS.

In Russia, a complete system of IS personnel training has long been established, based on Federal State Educational Standards (FSESs) of Higher Education (HE) and Professional Standards (PSs). Thus, the FSESs of HE of the last generation from the 10.00.00 "Information Security" Enlarged Group of Specialties and Directions of Training (EGSDT) formulate the general professional competencies (GPCs) of graduates who have been trained within a specific educational programme [9]. These competencies can be linked to the provisions of the currently valid PSs related to the "Specialists in the Field of Information Security" group of occupations (professions) [10].

In 2017, through the joint efforts of a group of professors from the world's leading universities engaged in educational activities in the field of cybersecurity, under the auspices of the Association for Computing Machinery (ACM), the IEEE Computer Society (IEEE CS), the Special Security Group of the Association of Information Systems (AIS SIGSEC) and the Working Group of the Technical Committee for Information Security Training of the International Federation for Information Processing (IFIP WG 11.8), the document titled "Cybersecurity Curricula 2017" (CSEC 2017) (Curriculum Guide in the field of Cybersecurity) was developed [11]. As the name implies, its main focus is not on competencies, but on the content and basic concepts of academic disciplines that are studied most often within the framework of the field of Cybersecurity.

All of the above-mentioned can be used as a basis for the development of professional competencies (PCs) in IS, first for SOC and then for NSIC personnel.

## 3 Labor Functions of NSIC Personnel

From an organizational point of view, a typical NSIC should include personnel consisting of operators working with current data and IS analysts who perform their in-depth analysis and carry out threat hunting, as well as NSIC management.
The NSIC staff depends on many factors, for example, the size and complexity of the organization's intranet, the number of previously detected IS incidents, the organizational NSIC's model, the working hours of the staff, the level of automation of its activities, and, of course, the willingness of the organization to allocate an appropriate budget to support its NSIC operations. (The issues related to the size of the NSIC staff are outside this paper's scope, since the main focus is on the professional training of personnel and their PCs.)

The staff of a typical NSIC can be divided into several groups, called tiers, according to their LFs. As the analysis showed, there are usually three or four tiers [12–14].

**Tier 1:** Briefly: The Tier 1 Operator monitors SIEM system alerts, manages and configures IS monitoring tools, prioritizes alerts or issues, and performs triage to confirm that a real IS incident is taking place.

Operators (Alert Investigators) continuously monitor all incoming data and its registration processes, they monitor the queue of hazard warnings generated by the IPTs and other systems, such as SIEM (Security Information and Event Management) systems, and determine the urgency of each alert, as well as perform prompt uncomplicated processing of that part of the data that for some reason cannot be processed in automated mode. These operators also monitor the operability of IS event data sources – network sensors and agents on endpoints. In the general flow of all data collected by heterogeneous sources related to IS events or presumably related to IS by established policies and rules, those data that indicate an IS incident are identified. They rely in their actions on pre-developed response scenarios (playbooks) – a sequence of operational actions when a specific type of IS incident is detected. If it takes more than a few minutes to process an event, they transmit (escalate) it to the second tier – to higher-level operators. Information about IS incidents, for which a high level of criticality is determined, is transmitted promptly – strictly within a set time (for example, 15 min). The Tier 1 operators can manage the IPTs and regularly prepare reports. Since their work requires special attention and quick reaction, they work in shifts. It is important that information about suspicious events should be transmitted not only to the Tier 2 specialists, but also between shifts, since many attacks are developing for hours, days, and sometimes years (as in the case of Advanced Persistent Threat (APT) attacks). The work of Tier 1 operators is easiest to automate. However, there are many specifics for each organization – its business processes, network topology features, etc.

**Tier 2:** Briefly: The Tier 2 Operators remedy attacks intensified from the Tier 1 Operators, receive incidents and perform deep analysis, correlate with Threat Intelligence (TI) to identify the threat actor, nature of the attack and systems or data affected, and decide on a strategy for containment, remediation, and recovery and act on it.

These operators (Incident Responders) usually have more experience. They can quickly find the cause of the detected problem, using correlation analysis of data obtained from various sources and assess which part of the organization's intranet is under attack. They strictly follow the procedures regulating the elimination of this problem and its consequences (their versions of playbooks have been developed for them – a sequence of operational actions when responding to a specific type of IS incident). If it fails and
the cause of the problem is not detected, they escalate it to Tier 3 for additional investigation. The Tier 2 operators can support the introduction of new analytical methods for detecting IS threats.

**Tier 3:** Briefly: Day-to-day, the Tier 3 Analysts conduct proactive vulnerability assessments and penetration tests, reviews alerts, industry news, TI, and data security, and actively hunt for threats that have found their way into the network, as well as for unknown vulnerabilities and security gaps. When a major incident occurs, they join the Tier 2 operators in responding and containing it.

Experts (Subject Matter Experts/Threat Hunters) are top-level network security analysts (they are always highly qualified people with extensive work experience) who can understand a unique situation by applying their knowledge and experience and comparing various events and facts related to an IS incident. Using IS threat detection tools (threat hunting), they analyze in detail all the information available at that moment to investigate the IS incident escalated to them from Tier 2, and actively search for vulnerabilities in the intranet. Investigation of a single incident can take from several minutes to several weeks as it often requires the collection of additional information related to an IS incident and the involvement of technical experts. Analytical experts analyze previously unknown and unknown IS events and new vulnerabilities, relying on various sources and historical data of the organization itself, for which they must have a clear understanding of the external and internal context of the functioning of the intranet. By investigating an IS incident, they can identify its characteristic features and transmit them to the appropriate IS monitoring systems and Tier 1 operators – thus, these experts are actively involved in the development, configuration, and implementation of analytics for detecting IS threats. Their task is to reconstruct the sequence of all the events before an IS incident, as well as to prepare recommendations for eliminating its consequences and improving the overall IS level for the intranet. Their task is to reconstruct the sequence of all the events before an IS incident, as well as to prepare recommendations for eliminating its consequences and improving the overall IS level for the intranet. In addition to IS analysts, the Tier 3 specialists also include IS auditors and specialists who collect digital evidence of IS incidents for their detailed investigation and, if necessary, transfer this information to law enforcement agencies.

**Tier 4:** Briefly: As in the case of a commander of a military unit, Tier 4 is responsible for hiring and training the NSIC staff, is in charge of defensive and offensive strategy, manages resources, priorities, and projects, and manages the team directly when responding to business-critical IS incidents. It acts as a point of contact for the business for IS incidents, compliance, and other security.

This tier consists of NSIC Senior Managers and Managers with extensive experience who are responsible for compliance with all applicable requirements, policies, and regulations and for coordinating the work of the entire NSIC. This group oversees all the activities of NSIC staff and performs administrative functions, including the management of strategies and tactics of NSIC operations, recruitment, shift management, budget management, necessary personnel training, as well as assessment of the overall results of NSIC functioning and the contribution of individual employees. The special role of Tier 4 is also evident during crisis situations when it serves as a link between the
NSIC staff and the rest of the organization. In addition, continuous communication with the relevant authorities should be carried out on this tier, if necessary.

The briefly described LFs of the staff of a typical NSIC can be clarified, depending on the needs of a particular organization.

## 4 Staff Roles of the State System for the Detection and Prevention of Computer Attacks

With the publication in August 2020 of the draft national standard GOST R, devoted to terms and definitions in the field of detection, prevention and elimination of consequences of computer attacks and response to computer incidents [15] on the website of the Federal Service for Technical and Export Control (FSTEC) of Russia, the following types of employee of the center of the State System for the Detection and Prevention of Computer Attacks (GosSOPKA) (NSIC's analog) were identified – specialists of three tiers with an indication of the roles they perform:

1. **Tier 1** – performing the following roles with the corresponding LFs:

* "Specialist in interaction with staff and users" – receiving messages from staff and users of information resources and preparing information for submission to the National Computer Incident Coordination Center (NCICC);

* "Specialist in detecting computer attacks and incidents" – analysis of IS events, registration of computer attacks and IS incidents; and

* "GosSOPKA Center Maintenance Specialist" – ensuring the functioning of funds placed in the GosSOPKA center, as well as additional IT infrastructure protection tools.

2. **Tier 2** – performing the following roles with the corresponding LFs:

* "Security assessment specialist" – inventory of information resources, identification of vulnerabilities, analysis of identified vulnerabilities and IS threats, establishing compliance of measures taken with the IS requirements;

* "Specialist in the elimination of the consequences of computer incidents" – coordination of actions to respond to computer incidents and bring IT infrastructure to normal operation; and

* "Specialist in determining the causes of computer incidents" – analysis of the causes of computer incidents, analysis of the consequences of incidents, and preparation of a list of computer incidents for submission to the NCICC.

3. **Tier 3** – performing the following roles with the corresponding LFs:

* "Analyst" – analysis of information provided by specialists of Tier 1 and Tier 2; identification and analysis of IS threats, forecasting their development, development of proposals for the revision of regulatory and methodological documents on IS;
* "Technical expert" – expert support under the specialization (malware, IPTs configuration, application of specialized technical means, security assessment, etc.), formation of proposals to increase the level of security; development of proposals for the revision of regulatory and methodological documents on IS issues;

* "Specialist" – regulatory legal and methodological support of the activities of the GosSOPKA center; and

* "Head" – management of all the activities of the GosSOPKA center, interaction with the NCICC, amendments to the relevant regulatory and methodological documents.

It should be noted that Tier 4 is not allocated in [15]. From our viewpoint, two roles from Tier 3, namely the "Specialist" and "Head" roles, can be attributed directly to Tier 4 in the case where the 4-tiers model suits an organization.

This set of roles with their LFs is taken further as a basis for defining PCs for them.

## 5 NSIC Personnel Competencies

The qualification characteristics of the NSIC personnel as IS specialists can be presented in the form of a set of competencies. A competency refers to a combination of observable and measurable knowledge, skills, and abilities, as well as individual attributes and work experience that contribute to enhanced NSIC personnel performance and ultimately result in organizational success [16]. Knowledge is the cognizance of facts, truths, and principles gained from formal training and/or experience. A skill is a developed proficiency or dexterity in mental operations or physical processes that is often acquired through specialized training, using the skill results in successful performance. An ability is a power or aptitude to perform physical or mental activities that are often affiliated with a particular profession. The ability to apply knowledge and skills in a productive manner, which can be characterized by such behavioral attributes as aptitude, initiative, willingness, communication skills, team participation, leadership, and others, shows the professional's effectiveness.

When training the NSIC personnel of all tiers, it is necessary to proceed from the fact that they must have modern PCs required to solve specific professional tasks and implement specific LFs. The PCs formation refers to the tasks solved by the existing education system, the regulatory framework of which in Russia is the complex of the FSESs of HE.

The analysis of the above-mentioned FSESs and PSs made it possible to establish the connection of NSIC personnel LFs objects and subjects with specific educational and professional standards:

* FSES of HE in the 10.04.01 "Information Security" training direction (Master's degree level);

* PS 06.032 "Specialist in security of computer systems and networks"; type of professional activity: protection of information in computer systems and networks (CS&Ns);

* PS 06.033 "Information security specialist in automated systems"; type of professional activity: ensuring the security of information in the automated systems (ASs).
A specific Master's degree programme that trains NSIC personnel within the framework of an educational standard should establish the following GPC (the graduate must be able to):

* GPC-1 justify the requirements for the ISMS and develop a draft technical specification for its creation;

* GPC-2 develop a technical design of a system (subsystem or component of a system) to ensure IS.

At the stage of developing a specific Master's degree programme curriculum and specific academic disciplines' syllabus to train specialists for NSICs, a competence-based approach should be applied. Based on this approach, we will formulate PCs for employees of all NSIC tiers:

1) **Tier 1: required knowledge:** fundamentals of information and network security, Windows, UNIX, and Linux operating systems, network protocols and TCP/IP, computer networking, routing and switching, familiarity with SQL, C, C++, C#, Java, or PHP programming languages;

* required technical skills: alert monitoring, security alert triages, monitoring of security sensors' and endpoints' "health", data collection, intrusion detection, work with packet analysis tools, IDS/IPS, penetration and vulnerability testing, firewalls, anti-virus, and anti-malware) and SIEM systems, etc.;

* non-technical skills: critical thinking, problem-solving abilities, capability to communicate, initiation of the Tier 2 work, and so on.

2) **Tier 2** – competencies of Tier 1 and additionally:
* required knowledge: forensics fundamentals, in-depth intrusion detection, hackers' tools and techniques, exploits, TI basics;

* required technical skills: log files' analysis, correlation of data from various sources, the basic assessment of malware and exploits, detection of affected systems and data, procedures for responding to incidents and formulating recommendations for their elimination, support for new analytic methods for detecting threats, collection of digital evidence of incidents on the network and hosts, etc.;

* non-technical skills: critical thinking, problem-solving abilities, capability to communicate, initiation of Tier 3 work and so on.

3) **Tier 3** – competencies of Tier 2 and additionally:
* required knowledge: in-depth knowledge of networks, endpoints, and TI, advanced network forensics, malware reverse engineering, specific applications or underlying IT infrastructure, general IS management issues;

* required technical skills: "Threat Hunting", involved in developing, tuning, and implementing threat detection analytics, including anomaly detection, aggregation, and advanced data analysis, Pen Testing, project management, IS management, IS incident management training, etc.;

* non-technical skills: critical thinking, problem-solving abilities, capability to communicate and to be a contact point for business-critical incidents, personnel management and shift scheduling, resource management, strategic and tactic planning, and so on.
The competencies listed in ISO/IEC 27021:2017 are fully suitable for Tier 3 personnel [8].

Of course, the training of NSIC personnel should be carried out constantly, for which the advanced retraining courses conducted by various training centers are intended. It is necessary because information, communication, and network technologies are evolving constantly, and new technologies are also emerging, which is reflected in the dynamically changing environment of the intranet and NSIC functioning as an integral part of it.

LFs and PCs have been developed for all the roles listed in Sect. 4, based on [17]. As an example, LFs and PCs are given only for the *NSIC Head*, representing Tier 4.

**LFs:**

* Manages the performance of work on information protection (IP) in organizations;

* Organizes the categorization of informatization objects, the identification of IS threats and technical channels of information leakage, work on special inspections, special studies, certification of informatization objects, licensing of organizations, the use of certified IPTs;

* Organizes the development of organizational and administrative documents in the field of IP;

* Participates in the consideration of technical assignments for research and development work on the development of products subject to protection;

* Develops proposals for inclusion in the plans and programs of work on IP. Participates in the work on the introduction of new IPTs;

* Promotes the dissemination of best practices in the organization and the introduction of modern organizational and technical measures, means, and methods of IP;

* Organizes measures to prevent leakage of restricted access information by officials of organizations performing work related to information constituting a state secret and/or containing other restricted access information when using open communication channels;

* Monitors compliance with the requirements of regulatory legal acts and other documents on IP;

* Organizes work to determine the need for IPTs, their order, receipt, and distribution;

* Participates in the selection and placement of specialists;

* Organizes work on certification, training, professional retraining, and advanced training of specialists in the field of IS, etc.

**PCs – knowledge:** to know:

* The laws of the Russian Federation regulating relations related to the protection of state secrets and other restricted access information;

* Regulatory and methodological documents on issues related to IP, planning of activities and control of work on IP;

* Methods and means of monitoring the IP effectiveness;

* Organizational structure of objects to be protected;

* Organization of activities of these objects and functioning of control, communication and automation systems on them;
* Rules for the organization of certification, licensing and certification in the field of IP;

* Measures for the protection and control of information, including when using open communication channels;

* Methods of identifying IS threats and methods of IP against them;

* The procedure for concluding contracts for conducting special studies and special inspections;

* Technical capabilities of special equipment of IP units, the basics of its operation, organization of maintenance and repair;

* Methods for assessing the capabilities of technical exploration;

* The procedure for categorizing objects;

* Requirements for registration of inspection certificates, test reports, prescriptions for the right to operate basic and auxiliary equipment and systems;

* Methods for assessing the professional level of IS specialists, certification of specialists;

* Fundamentals of economics, production organization and personnel management;

* Fundamentals of labor legislation; rules on labor protection and fire safety, etc.

## PCs – skills:

* To form and establish the directions of the NSIC's activities in the field of IP;

* To provide recommendations, to define goals and stimulate the successful solution of tasks related to IP at various levels of their execution;

* To distribute responsibilities and powers on all NSIC's tiers;

* To analyze the security of ICT systems and develop recommendations for the operation of the IP systems (IPSs);

* To formulate information security policies for ICT systems;

* To summarize scientific and technical literature, normative and methodological materials in the field of IP;

* To form models of the IS threats and the IS intruders for ICT systems;

* To identify the most appropriate approaches to the ICT systems;

* To develop private IS for ICT systems, including access control and information flow policies;

* To apply the current legislative framework in the field of IS;

* To develop and to apply methods for assessing the security of software and hardware IPSs;

* To be able to evaluate the IP effectiveness;

* To be able to analyze the system in order to determine the security and trust levels;

* To apply the procedure for categorizing objects;

* To apply methods for assessing the professional level of IS specialists and their certification;

* To analyze IS policy for the adequacy of established IS requirements and measures;

* To compile and to issue an analytical report on the results of the analysis;

* To conduct research in order to find the most appropriate practical solutions for IP;

* To select and summarize scientific and technical literature, methodological materials on software and hardware and methods of IP, etc.
# 6 Mephi's Readiness to Implement a Master's Degree Programme for Training Personnel for NSICS

The Master's degree programmes being implemented at the MEPhI have for many years been designed to train IS professionals in the 10.04.01 "Information Security" direction. One of the four Master's degree programmes of the MEPhI is the "Information Security and Business Continuity Maintenance" programme, which has been successfully implemented for 10 years [18]. It ensures the implementation of the following disciplines designated in the 10.04.01 FSES of HE as the basic disciplines of the professional module: "Information Security Management" and "Information Security Maintenance Technologies" (ISMT), as well as the "Information Security Incident Management", "Information Security Risk Management", "Business Continuity Management", "IT Security Assessment", "Secure Information Systems", "Computer Network Security", "Modern Information Technologies in the Banking Sector" and "Confidential Information Loss Prevention" disciplines.

Since 2020, a new "Network Security Management Centers" discipline has been introduced into the Master's degree programme.

The availability of all of the above disciplines proves the full readiness of our programme to meet the increasing need for training highly qualified specialists for SOCs. The following disciplines, such as "Analytical Methods for Big Data Processing" and "Methods for Visualizing of Network Security-Related Information" should be added.

Among those listed, we can single out the "ISMT" discipline, the content of which most fully corresponds to the LFs of the personnel of all NSIC tiers. It is an original discipline developed at the MEPhI 20 years ago and is currently taught in all educational institutions of the Russian Federation, where Masters in IS are trained.

The educational programme of the Master's degree programme in accordance with the 10.04.01 FSES establishes a link between the "ISMT" discipline and GPC-1 and GPC-2 by formulating GPC Achievement Indicators (AI) [19, 20]. For the "ISMT" discipline, these indicators will be as follows:

* for GPC-1: GPC-1.1.1 to know the basics of domestic and foreign standards in the field of IS; GPC-1.2.1 to be able to design the terms of reference for the ISMS creation; GPC-1.3.1 to have the skills to participate in the ISMS development;

* for GPC-2: GPC-2.1.1 to know the methods of conceptual design of ISM technologies; GPC-2.2.1 to be able to choose and justify the use of methods for solving IS problems; GPC-2.3.1 to have the skills to perform work in the development and operation of ISM systems and tools.

With reference to the "ISMT" discipline, the above-mentioned GPC can be compared with the generalized LFs (GLFs) and related LFs given in PS 06.032 and PS 06.033. At the same time, only those GLFs and LFs that are directly related to NSIC are highlighted:

* PS 06.032 "Specialist in security of CS&Ns":
* GLF-S: Assessment of the security level of CS&Ns:
* LF-S/01.7: Conducting control checks of the operability and effectiveness of the applied software and hardware IPTs.
LF-S/02.7: Development of IS requirements and IS policies for CS&Ns.

GLF-D: Software and hardware IPTs development for CS&Ns:

LF-D/01.8: Development of requirements for software and hardware IPTs for CS&Ns.

LF-D/02.8: Design of software and hardware IPTs for CS&Ns.

LF-D/03.8: Development and testing of IPTs for CS&Ns.

LF-D/04.8: Support for the development of IPTs for CS&Ns.

PS 06.033 "Information security specialist in ASs":

LTF-D: Development of AS IS systems:

LF-D/01.7: Testing of AS IS systems.

LF-D/02.7: Development of design solutions for AS IP.

LF-D/03.7: Development of operational documentation for AS IS systems.

LF-D/04.7: Development of software and hardware tools for AS IS systems.

GLF-E: Formation of requirements for the AS IP:

LF-E/01.8: Justification of the need in AS IP.

LF-E/02.8: Identification of threats to the security of information processed by the AS.

LF-E/03.8: Development of the AS IS system architecture.

LTF-E/04.8: Modeling of secure AS in order to analyze their vulnerabilities and the effectiveness of IP tools and methods.

For the practical training of NSIC personnel, it is necessary to use the Cyber Polygon being created in many countries in general and universities in particular, the deployment of which at the MEPhI has been delayed due to the transition to distance learning because of the pandemic [21].

## 7 Conclusion

At present and as the next step of their evolution, more and more professionals for SOCs and NSICs are required all over the world. The contribution of this study in overcoming staff shortage was to formulate some important initial proposals for the development of a Master's degree programme for training highly qualified personnel for SOCs and NSICs with different roles and LFs as the first obvious solution.

Another step could be the development of a professional standard for training specialists for SOCs and NSICs. Thus, the obvious conclusion is that the issue of training personnel for intelligent network security management is extremely relevant and requires an immediate solution. The paper presents some considerations that can serve as a starting point for the beginning of this process.

It should be noted that the results obtained are more valuable at the international rather than the national level, since SOCs and NSICs are created in companies in many countries, not only in Russia. They are based on the generalization of all the international sources that have already been analyzed in [7].

**Acknowledgement.** This work was supported by the MEPhI Academic Excellence Project (agreement with the Ministry of Education and Science of the Russian Federation of August 27, 2013, project no. 02.a03.21.0005).
References

1. Zimmerman, C.: Ten Strategies of a World-Class Cybersecurity Operations Center. MITRE 2014. https://www.mitre.org/sites/default/files/publications/pr-13-1028-mitre-10-strategies-cyber-ops-center.pdf. Accessed 4 Apr 2022

2. Yankin, A.: SOC: the staff decides everything. Information Security. ITSEC. 2016. Iss. 1. http://lib.itsec.ru/articles2/Oborandteh/soc-kadry-reshayut-vse. Accessed 4 Apr 2022. (In Russian)

3. Freudenberg, H.J.: Staff burn-out. J. Soc. Issues 30(1), 159–165 (1974). https://doi.org/10.1111/j.1540-4560.1974.tb00706.x

4. Miloslavskaya, N.: Network security intelligence center as a combination of SIC and NOC. In: Postproceedings of the 9th Annual International Conference on Biologically Inspired Cognitive Architectures, BICA 2018 (Ninth Annual Meeting of the BICA Society). Procedia Computer Science. 2018, vol. 145, pp. 354–358. https://doi.org/10.1016/j.procs.2018.11.084

5. Miloslavskaya, N.: Developing a network security intelligence center. In: Postproceedings of the 9th Annual International Conference on Biologically Inspired Cognitive Architectures, BICA 2018 (Ninth Annual Meeting of the BICA Society). Procedia Computer Science, vol. 145, pp. 359–364 (2018). https://doi.org/10.1016/j.procs.2018.11.085

6. Miloslavskaya, N.: Security zone infrastructure for network security intelligence centers. In: Postproceedings of the 10th Annual International Conference on Biologically Inspired Cognitive Architectures, BICA 2019 (Tenth Annual Meeting of the BICA Society), Samsonovich, A.V., Klimov, V.V. (ed.) Procedia Computer Science, vol. 169, pp. 51–56, 15 April 2020. ISSN 1877–0509. https://doi.org/10.1016/j.procs.2020.02.113

7. Miloslavskaya, N., Tolstoy, A.: State-level views on professional competencies in the field of IoT and cloud information security. In: Proceedings of 2016 4th International Conference on Future Internet of Things and Cloud Workshops. The 3rd International Symposium on Intercloud and IoT (ICI 2016). Vienna (Austria), 22–24 August 2016, pp. 83–90. https://doi.org/10.1109/W-FiCloud.2016.31

8. ISO/IEC 27021:2017 Information technology — Security techniques — Competence requirements for information security management systems professionals. 21 p.

9. Methodological Materials of the XXII Plenum of FUMO VO IB. Drafts of FGOS VO 3++ UGSNP 10.00.00 «Information Security». Krasnodar: Publishing House – South, 2018. 140 p. (In Russian)

10. Scientific, Methodological and Normative Materials of the XX Plenum of FUMO VO IB. Collection of Professional Standards for the Group of Occupations (Professions) "Information security specialists". Moscow, 2016. 198 p. (In Russian)

11. Cybersecurity Curricula 2017. Curriculum Guidelines for Post-Secondary Degree Programs in Cybersecurity. A Report in the Computing Curricula Series Joint Task Force on Cybersecurity Education. https://www.acm.org/binaries/content/assets/education/curricula-recommendations/csec2017.pdf. Accessed 4 Apr 2022

12. Orion, C.: Security Operations Center Roles and Responsibilities. 2019. https://www.exa.beam.com/security-operations-center/security-operations-center-roles-and-responsibilities/. Accessed 4 Apr 2022

13. Role and Responsibilities of a SOC Analyst. 2021. https://www.infosectrain.com/blog/role-and-responsibilities-of-a-soc-analyst/. Accessed 4 Apr 2022

14. Balaji, N.: How to Build and Run a Security Operations Center 2021. https://gbhackers.com/how-to-build-and-run-a-security-operations-center/. Accessed 4 Apr 2022

15. GOST R «Data Protection. Detection, Prevention and Elimination of the Consequences of Computer Attacks and Response to Computer Incidents. Terms and Definitions». Draft. https://fstec.ru/en/component/attachments/download/2770. Accessed 4 Apr 2022. (In Russian)
16. Budzko, V., Miloslavskaya, N., Tolstoy, A.: Forming the abilities of designing information security maintenance systems in the implementation of educational programmes in information security. In: Drevin, L., Theocharidou, M. (eds.) Information Security Education – Towards a Cybersecure Society. WISE 2018. IFIP Advances in Information and Communication Technology, vol. 531, pp. 108–120. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-99734-6_9

17. Unified Qualification Reference Book of Positions of Managers, Specialists and Employees. The “Qualification Characteristics of the Positions of Managers and Specialists in Ensuring Information Security in Key Information Infrastructure Systems, Countering Technical Intelligence and Technical Protection of Information” Section. https://docs.cntd.ru/document/902156801#6500IL. Accessed 4 Apr 2022. (In Russian)

18. Miloslavskaya, N., Senatorov, M., Tolstoy, A., Zapechnikov, S.: “Business continuity and information security maintenance” masters’ training program. IFIP Advances in Information and Communication Technology. Dodge, R.C., Futcher, L. (eds.): Information Assurance and Security Education and Training - 8th IFIP WG 11.8 World Conference on Information Security Education, WISE 8, Auckland, New Zealand, 8–10 July 2013, Proceedings, WISE 7, Lucerne Switzerland, 9–10 June 2011, and WISE 6, Bento Gonçalves, RS, Brazil, 27–31 July 2009, Revised Selected Papers. vol. 406, pp. 95–102. Springer, Berlin (2013). https://doi.org/10.1007/978-3-642-39377-8_10

19. Methodological Materials of the XXIII Plenum of FUMO VO IB. Part 1. Drafts of Exemplary Basic Educational Programmes for Bachelor's and Master's Degrees (according to the FGOS VO 3 ++) USSNP 10.00.00 "Information Security". Stavropol, 2019. 52 p. (In Russian)

20. Training of Masters in the 10.04.01 Direction: Working Curricula and Competence Models. http://www.mephi.ru. Accessed 4 Apr 2022. (In Russian)

21. Miloslavskaya, N., Tolstoy, A.: Cyber polygon site project in the framework of the MEPhI network security intelligence center. In: Proceedings of the Annual International Conference on Brain-Inspired Cognitive Architectures for Artificial Intelligence (BICA*AI 2020), Natal, Brazil, 15 November, vol. 1310, pp. 295–308. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-65596-9_36