A case analysis of information systems and security incident responses

Ahmad, Atif; Maynard, Sean B.; Shanks, Graeme

doi:10.1016/j.ijinfomgt.2015.08.001

Cited by 62 publications

(42 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Ineffective knowledge gathering tends to result in the waste of the knowledge generated in the incident handling process [24]. The findings were consistent with Ahmad's case studies in financial organisations [24,25]. However, our study was placed in a healthcare context and the target group included not only IT professionals but also healthcare professionals.…”

Section: Incident Learning and Knowledge Gatheringsupporting

confidence: 83%

“…This indicated poor collaborations between the incident handler and the incident reporter. This findings is also shared by Ahmad [24,25] and Tondel [31] According to Cook, critical incidents were caused by ignorance of low impact incidents and all incidents should be used for incident learning [51]. This was not occurring in the redacted hospital.…”

Section: Incident Learning and Knowledge Gatheringmentioning

confidence: 72%

Section: Lessons Learned and Security Incident Response And Handlingmentioning

confidence: 99%

“…The case studies performed by Ahmad showed that the organisation had focused on improving the technical aspects and did not leverage opportunities to learn about incidents [24,25]. He then proposed a double-loop model for incident learning [24] and a dynamic security learning (DSL) process model elaborating different learning activities in different learning stages, key stakeholders involved and its linkage with broader organisational aims [25]. Tondel [31] had identified the key challenges of incident learning which included the lack of willingness to share incident learning with other organisations [32] ineffective communication between IT professionals and other stakeholders [32] the lack of incident learning motivations [32] as well as the insufficient sharing of security lessons within the organisation [23].…”

Section: Lessons Learned and Security Incident Response And Handlingmentioning

confidence: 99%

“…The response to these lessons learned should ideally cycle relevant knowledge and changes into the procedures that guide incident response and result in changes in the training processes and incident response policies. However, case studies [23][24][25] showed that incident learning is ineffective in the organisations.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Challenges of information security incident learning: An industrial case study in a Chinese healthcare organization

Johnson

2017

Informatics for Health and Social Care

View full text Add to dashboard Cite

Security incidents can have negative impacts on healthcare organisations and the security of medical records has become a primary concern of the public.However, previous studies showed that organisations had not effectively learned lessons from security incidents. Incident learning as an essential activity in the "follow-up" phase of security incident response lifecycle, has long been addressed but not given enough attention. This paper conducted a case study in a healthcare organisation in China to explore their current obstacles in the practice of incident learning. We interviewed both IT professionals and healthcare professional. The results showed that the organisation did not have a structured way to gather and redistribute incident knowledge. Incident response was ineffective in cycling incident knowledge back to inform security management.Incident reporting to multiple stakeholders faced a great challenge. In response to this case study, we suggest the security assurance modelling framework to address those obstacles.

show abstract

Section: Incident Learning and Knowledge Gatheringsupporting

confidence: 83%

Section: Incident Learning and Knowledge Gatheringmentioning

confidence: 72%

Section: Lessons Learned and Security Incident Response And Handlingmentioning

confidence: 99%

Section: Lessons Learned and Security Incident Response And Handlingmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Challenges of information security incident learning: An industrial case study in a Chinese healthcare organization

Johnson

2017

Informatics for Health and Social Care

View full text Add to dashboard Cite

show abstract

How integration of cyber security management and incident response enables organizational learning

Ahmad

Desouza

Maynard

et al. 2019

Asso for Info Science & Tech

View full text Add to dashboard Cite

Digital assets of organizations are under constant threat from a wide assortment of nefarious actors. When threats materialize, the consequences can be significant. Most large organizations invest in a dedicated information security management (ISM) function to ensure that digital assets are protected. The ISM function conducts risk assessments, develops strategy, provides policies and training to define roles and guide behavior, and implements technological controls such as firewalls, antivirus, and encryption to restrict unauthorized access. Despite these protective measures, incidents (security breaches) will occur. Alongside the security management function, many organizations also retain an incident response (IR) function to mitigate damage from an attack and promptly restore digital services. However, few organizations integrate and learn from experiences of these functions in an optimal manner that enables them to not only respond to security incidents, but also proactively maneuver the threat environment. In this article we draw on organizational learning theory to develop a conceptual framework that explains how the ISM and IR functions can be better integrated. The strong integration of ISM and IR functions, in turn, creates learning opportunities that lead to organizational security benefits including: increased awareness of security risks, compilation of threat intelligence, removal of flaws in security defenses, evaluation of security defensive logic, and enhanced security response.

show abstract

The Effectiveness of Outsourcing Cybersecurity Practices: A Study of the Italian Context

Annarelli

Colabianchi

Nonino

et al. 2021

Proceedings of the Future Technologies Conference (FTC) 2021, Volume 3

View full text Add to dashboard Cite

A case analysis of information systems and security incident responses

Cited by 62 publications

References 15 publications

Challenges of information security incident learning: An industrial case study in a Chinese healthcare organization

Challenges of information security incident learning: An industrial case study in a Chinese healthcare organization

How integration of cyber security management and incident response enables organizational learning

The Effectiveness of Outsourcing Cybersecurity Practices: A Study of the Italian Context

Contact Info

Product

Resources

About