SECURWARE 2016 : The Tenth International Conference on Emerging Security Information, Systems and Technologies

Study on Dual Data Structure
in Enterprise Information Security Architecture

Mikio Suzuki

Fumihiro Kubota

President of eVan TEC, Ltd.
Tokyo, Japane-mail: mikioszk@evan-tec.com

eVan TEC, Ltd.
Tokyo, Japane-mail: fkubota@evan-tec.com

Abstract— Security Operation Center is known as a centralized
team within the organization working against critical cyberthreat by mainly analyzing logs. This paper points out theduality of information on Security Operation Center andproposes several issues according to its new security scheme
and also raised awareness to protect confidential businessinformation and employees’ rights of privacy.

Let us take an example to understand the duality of data
mentioned above. One might easily recognize that most of
the log data might be business relating data. However, verysmall combinations of log data, very difficult to find, might
possibly be related to cyber attacks, although each log does
not indicate the illegal action. This means the log data has
another aspect of information relating to businessintelligence as well as cyber attack information.
Data confidentiality should be classified into three ranks(High, Middle, and Low) in designing of an information
security policy [4]. It seems that the low rank data takes alow risk; however, it might be reclassified into a high risk
data after being analyzed by SOC. This implies low rankdata cannot be assumed as low risk data without analyzing.

Keywords—Security Operation Center; logs; Dual Data
Structure; Information Security Policy.

I.

INTRODUCTION

An increase in sophisticated cyber attacks seems to be allover the world. The essential cause of this fact is that theInternet is open and free. Although this aspect brings great
advantages in our highly informed society, it causes thethreat of cyber attacks. Security Operation Center (SOC)
specializes in investigating cyber attacks by analyzing logs[1]. Security Information Event Management (SIEM) is arelated technology for analyzing logs automatically [2]. In
other words, analyzing the logs is essential to make counter
strategies against cyber attacks. However, the results ofanalyzing of logs include not only cyber attack data, but also
confidential business intelligence and private information.
This paper points out the recognition of dual data structure indata flow of SOC and the necessity of developing aninformation security policy on SOC.
II.

DATA STRUCTURE

A. Dual data structure on the information security
To study the data flow in an enterprise computer system,
we consider the Enterprise Architecture (EA), which is amethodology or a guideline for entities in an enterprise tonormalize information and optimize business strategies [3].
Then, we study the data flow among the entities which
compose the EA. As depicted in Fig. 1, data flow between
entities is an objective of our study. Business process causes
data flows between entities. At the same time, the result ofobserving or monitoring the data by SOC includes businessdata flow as well as intelligence data or private data. In thisstudy, we refer to this fact as “dual data structure”.

Copyright (c) IARIA, 2016.

ISBN: 978-1-61208-493-0

Component(Entity)Component(Entity)“Dual data structure in their information is shown byanalyzing the information between Entities.”
Figure 1. Dual Data Structurer generated by two entities

B. Several effects on the information security caused byDual Data Structure
Dual Data Structure changes several aspects ininformation security architecture as follows.
1) Dual Data Structure in SOC changes Reference Monitor
Model (RM)
In designing SOC and the related RM concept [5],technical qualification needs to be reconsidered as anessential security model. In Fig. 2, the log database isproduced by each monitoring log data and, after analyzing
the log database, new confidential information will emerge.
It indicates that security requirements have to focus on theissue of dual data structure when building SOC scheme aswell.

320

SECURWARE 2016 : The Tenth International Conference on Emerging Security Information, Systems and Technologies

SecurityPolicy

SUBJECT(Users, Program, Process,etc.)

OBJECT(Intelligence data,Program, Hard ware, etc.)

Reference
MonitorIt becomesconfidential
Logs,Inspecting files

DB after analyzing

Figure 2. Information Reference Model [4].

2) Dual Data Structure in SOC relating privacy
The basic structure of log data contains the user
information, such as, ID information, or name, time, subject,object and behavior as depicted in Fig. 3. This issue should
be under the privacy impact assessment [5] andTokenization or Anonymous is also under theconsideration to be introduced into the log data structure.
Log DataStructure

Who When, Where, How,ID,
IP Address
User nameResult ofanalysis

Timestamp,Device, (Subject, Object)
Application Command・Biz Application Process・Miss Operation
・Cyber attack
・Employees’ right of privacy

Figure 3. Dual Data Strucuture in SOC data.

1) Data handling policy of DB based on log data
Those data should be kept in highly confidential status
and integrity of the data should be kept safe.
2) Review of Privacy impact assessment
Privacy impact analysis should be studied in design stageof SOC as well as operational stage.
3) Outsourcing of SOC work
Review the risk of outsourcing of SOC taking into
account the duality of SOC data. We would like tosuggest that outsourcing of SOC work had better beavoided.
III. CONCLUSION
This paper points out a duality in EA data. From thecomprehensive thoughts, it is concluded that recognition ofdual data structure and necessity of developing information
security policy regarding SOC must be argued.
This idea contribution raised the importance to consider thedual aspect in information security. The followings areexpected for further study.
1) Information security policy of SOC
To the best knowledge of the authors, there is no security
policy relating to SOC which is taking duality intoaccount.
2) Advanced analyzing logs in duality
Maching learning is the new trend in analyzing logs.
Duality in the result of analyzing logs must be governedby the above information security policy.
REFERENCES[1][2]

C. Understanding Dual Data Structure
To understand the essential meaning of Dual DataStructure, we suppose the concept of “Unknown unknowns”[6]. Critical targets of SOC are “Unknowns”. They arealmost impossible to identify. In other words, under thecondition of “unknown unknowns”, SOC is working on daily
missions to analyze unknowns of cyber attacks.
Professionals of Information Security in SOC should
transfer the status “Unknown unknowns” to the status“Unknown known”. This means that they present the actualattack evidence from the results of SIEM by their experienceor the outside information, and transfer findings tomanagerial persons of the enterprise. In case of both outside
or inside SOC analyzing log data which belongs to anenterprise, a professional has the responsibility to analyze theresults.

[3]
[4]
[5]
[6]

[7]

Barbara A Nadel, “Building security: handbook for architecturalplanning and design”, McGraw-Hill, 2004, p.220.
David R. Miller, Shon Harris, Alan Harper, Stephen VanDyke, andChris Blask "Security information and event management
implementation" McGraw-Hill Education; 2010
Col Perks, and Tony Beberidge, “Guide to enterprise IT architecture”
Springer-Verlag New Yourk, Inc., 2003.
US Department of defense, “Trusted computer system evauation
criteria (TCSEC)”, DoD 5200.28-STD, December 26, 1985.
CISSP® Common body of knowledge review, “Security architecture& design domain” Version 5.10, P.65.
David Wright and Paul de Hert, "Privacy Impact Assessment (Law,Governance and Technology Series)", Springer; 2012 edition (July 22,2012).
Charles Saatchi, "Unknown unknowns", Booth-Clibborn; First
Edition, 2015.

D. The issue of security policy relating to SOC
We have studied several aspects of data relating to SOC
in terms of RM, privacy rights. Further discussions about
information security policy related to duality are as follows.

Copyright (c) IARIA, 2016.

ISBN: 978-1-61208-493-0

321