Nurse scheduling problem in Security Operations Centers

What is the Nurse scheduling Problem ?

Nurse scheduling problem ( or Nurse rostering problem ) is the operational problem of finding the most optimal way to assign shifts to nurses due the number of constraints ( hard & soft ) that must be considered while creating the schedule.

Mathematically this is a complex combinatorial optimisation problem known as NP-hard because the number of possible shift combinations grow exponentially as add more nurses and days.

Why is the Nurse scheduling Problem a Problem ?

A hospital ward runs 24/7, this requires nurses to be available to be in the ward 24/7. To provide 24/7 coverage nursing shift work is divided into shifts that runs throughout. However for the shifts to be assigned and for the final roster to be created, multiple hard and soft constraints must be considered and solved against.

A few example constraints :

• 1.Certain number of people on every shift,some of them senior.
• 2.Nobody can work two shifts in a day
• 3.Everyone needs rest between shifts
• 4.Nights come in runs that have to end
• 5.Weekends should be whole.
• 6.Other preferences

Manually creating the roster every month taking into account the different constraints is time consuming and complex which is why the nurse scheduling problem is a problem.

How does this apply to Security Operations Center's ( SOCs )

The nurse scheduling problem directly maps on to the scheduling nature of a security operations center as the mechanisms are similar. We haven't seen this named anywhere else, so we're calling it the Analyst Rostering Problem.

The ward becomes the SOC floor. The roles of head nurse, nurse, and caretaker map onto SOC Manager, SOC Lead, and T1, T2, T3 analysts. The demand that comes from patients on a ward becomes demand from clients or alerts in a SOC and finallt constraints

What are hard and soft constraints ?

The nurse rostering framing's most useful lesson is not the list of constraints. It is the split between the ones that cannot be broken and the ones that should not be. Hard constraints dictate what a valid schedule looks like while the soft constraints dictate the quality of the roster that's produced.

Examples of hard constraints:

• 1.Coverage is a hard constraint, a shift below its minimum is a breach of contract.
• 2.Rest is also a hard constraint, often mandated by labour law (this varies by jurisdiction).
• 3.One shift a day per analyst is also typically a hard constraint, for the same reason.

Examples of soft constraints:

• 1.Days off should come in pair, a good rule.
• 2.Nights should come in runs of no more than four, a good rule.

But a roster that cannot break them is a roster that does not exist in a week when two people are on leave and one is off sick. The solver has to be allowed to break a soft rule, at a cost, when the alternative is no roster at all and the cost has to be visible, so that a manager can see which rule gave way and for whom.

“

A rota that cannot break "days off should come in pairs" is a rota that does not exist in a short-staffed week.

A Worked Mini-Example

Take three analysts Alice, Bob, Chen covering two shifts a day (Day, Night), Monday to Wednesday. The hard constraint, every shift needs at least one analyst. The soft constraint, days off should come in pairs.

This roster satisfies the hard constraint every shift is covered. But look at Alice, she's off on Wednesday only. If Thursday is a working day for her, that single day off is sandwiched between two shifts, not paired with anything the soft constraint breaks.

A solver faced with this has two options, extend Alice's day off into Thursday (which might leave Thursday under-resourced unless someone else picks up the slack), or accept the broken soft constraint and flag it. Neither is "correct", it depends on what else is short-staffed that week. What matters is that the roster doesn't just silently produce Alice's isolated day off, it surfaces the trade off so a manager can decide whether it's acceptable, or whether it's worth reshuffling Bob or Chen instead.

This is the whole argument in miniature, hard constraints get enforced, soft constraints get a cost, and someone accountable sees the cost before the roster goes out.

The Point

Hospitals solved this decades ago. Once the nurse rostering problem had a name, it stopped being an ad hoc scheduling headache and became something purpose built software could solve, not left to whatever a manager could hold in their head.

Security operations never got that. SOCs have been running the same analyst rostering problem without a tool built for it, patched together with spreadsheets and goodwill instead.

That changes now.