Question

Lucy is the SOC operator for her organization and is responsible for monitoring her organization's SIEM and other security devices. Her organization has both domestic and international sites, and many of their employees travel frequently.

After her discovery in the first part of this question, Lucy is tasked with configuring alerts that are sent to system administrators. She builds a rule that can be represented in pseudocode as follows: Send a SMS alert every 30 seconds when systems do not send logs for more than 1 minute. The average administrator at Lucy's organization is responsible for 150 to 300 machines. What danger does Lucy's alert create?
A. A DDoS that causes administrators to not be able to access systems
B. A network outage
C. Administrators may ignore or filter the alerts.
D. A memory spike

Answer 1

Lucy's alert system may lead to 'alert fatigue' as system administrators managing a large number of machines might ignore or filter out the numerous alerts, potentially missing critical information.

The Correct Option is; C. Administrators may ignore or filter the alerts.

Step-by-step explanation:

Lucy's alert creates the danger of administrators ignoring or filtering the alerts, option C. If the administrators are responsible for 150 to 300 machines and each machine sends an SMS alert every 30 seconds when logs are not received for more than one minute, administrators may receive an overwhelming number of alerts.

This high volume of alerts could lead to a situation known as 'alert fatigue' where the sheer number of alerts causes administrators to either ignore or filter out the alerts, potentially missing critical information.

The findings of Bruno & Abrahão (2012) demonstrate that increasing cognitive load can lead to more mistakes in decision-making. This suggests that an abundance of alerts could degrade the accuracy of administrators' responses to real threats.

The infamous case of the Target data breach in 2013 also illustrates the consequences of security personnel not interpreting alerts correctly due to high cognitive demand or other factors.