To read this content please select one of the options below:

Developing expertise for network intrusion detection

John R. Goodall (Secure Decisions Division, Applied Visions, Inc., Northport, New York, USA)
Wayne G. Lutters (Department of Information Systems, University of Maryland, Baltimore, Maryland, USA)
Anita Komlodi (Department of Information Systems, University of Maryland, Baltimore, Maryland, USA)

Information Technology & People

ISSN: 0959-3845

Article publication date: 5 June 2009




The paper seeks to provide a foundational understanding of the socio‐technical system that is computer network intrusion detection, including the nature of the knowledge work, situated expertise, and processes of learning as supported by information technology.


The authors conducted a field study to explore the work of computer network intrusion detection using multiple data collection methods, including semi‐structured interviews, examination of security tools and resources, analysis of information security mailing list posts, and attendance at several domain‐specific user group meetings.


The work practice of intrusion detection analysts involves both domain expertise of networking and security and a high degree of situated expertise and problem‐solving activities that are not predefined and evolve with the dynamically changing context of the analyst's environment. This paper highlights the learning process needed to acquire these two types of knowledge, contrasting this work practice with that of computer systems administrators.

Research limitations/implications

The research establishes a baseline for future research into the domain and practice of intrusion detection, and, more broadly, information security.

Practical implications

The results presented here provide a critical examination of current security practices that will be useful to developers of intrusion detection support tools, information security training programs, information security management, and for practitioners themselves.


There has been no research examining the work or expertise development processes specific to the increasingly important information security practice of intrusion detection. The paper provides a foundation for future research into understanding this highly complex, dynamic work.



Goodall, J.R., Lutters, W.G. and Komlodi, A. (2009), "Developing expertise for network intrusion detection", Information Technology & People, Vol. 22 No. 2, pp. 92-108.



Emerald Group Publishing Limited

Copyright © 2009, Emerald Group Publishing Limited

Related articles