A Security Coordination Model for an Inter-Organizational Information Incidents Response Supporting Forensic Process

Abstract

The high cost for information security incident response makes organizations hesitate to possess their own expert security team. Also organizations are still reluctant to share their own security circumstances with external organizations. By the way, they hope experts will help to defend against cyber threats without losing their reputations. To satisfy these requests of organizations, we propose a security coordination model that supports security incidents response in an organizational architecture, in this paper. Besides, our model has cyber forensic functions for collecting digital evidences from real time monitoring and on-site investigation of the incidents and reporting the analysis results to authorized organizations effectively.

A Multi-Vocal Review of Security Orchestration

“…Decision Service Unit: Most of the reviewed security orchestration systems have decision services unit that orchestrates the activities for automated decision-making [78,81,84,95]. The decision service unit makes security policy decision(s) related to vulnerability and threat assessment and assessment of security enforcement system [60].…”

“…Most of the incident response teams follow no collaborative process while planning how to respond to a particular incident which results in poor strategies plan [45]. Several papers [30,59,78] reveal that stakeholders from different organizations are unwilling to share threat intelligence with each other. Jeong et al [78] have reported organizations' fear of losing reputation is one of the reasons for their unwillingness to share their security circumstances with other organizations.…”

A Model for Optimal Planning of Information Security Incident Response Operations

“…They hope that experts can help them defend from cyber threats without damaging their reputation. To meet these needs of organizations, a co-ordination model that supports response to security incidents in organizational architecture is proposed [13]. Additionally, the model also supports the function of presenting and submitting digital evidence to competent authorities during real-time monitoring and incident investigation.…”

A Comparative Assessment of Computer Security Incidence Handling

“…Individual organisations are rarely able to maintain enough knowledge and expertise to respond to all emergent computer incidents, hence the need for collaboration with other external organisation and law enforcements. However, to remove potential threats like data privacy breaches, that are potential deterrents to this approach, the model brings to light the concept of Participant Organisation (PO) and Coordinator Organisation (CO) [11]. PO refers to individual organisation affected and that need to share information to ensure timely and successful neutralisation of an incident.…”

“…The model also incorporates a forensic process that extracts real-time and onsite digital evidence from monitoring systems; furnishing external organisations with the results of an analysis of such evidences, to prevent future reoccurrence [11]. Foundation blocks for this security coordination model include; real-time detection and result reporting of cyber-attacks on the part of POs, provision of online/onsite response support, propagating security events based on digital evidence collected from real-time monitoring and onsite examination of security incidents in the POs, and sharing security incident events with external organisations [11]. Greater emphasis is on communication amongst external organisations, coordination organisation and participant organisations.…”