Computer Security Incident Response Team Effectiveness: A Needs Assessment

Abstract

Computer security incident response teams (CSIRTs) respond to a computer security incident when the need arises. Failure of these teams can have far-reaching effects for the economy and national security. CSIRTs often have to work on an ad hoc basis, in close cooperation with other teams, and in time constrained environments. It could be argued that under these working conditions CSIRTs would be likely to encounter problems. A needs assessment was done to see to which extent this argument holds true. We constructed an incident response needs model to assist in identifying areas that require improvement. We envisioned a model consisting of four assessment categories: Organization, Team, Individual and Instrumental. Central to this is the idea that both problems and needs can have an organizational, team, individual, or technical origin or a combination of these levels. To gather data we conducted a literature review. This resulted in a comprehensive list of challenges and needs that could hinder or improve, respectively, the performance of CSIRTs. Then, semi-structured in depth interviews were held with team coordinators and team members of five public and private sector Dutch CSIRTs to ground these findings in practice and to identify gaps between current and desired incident handling practices. This paper presents the findings of our needs assessment and ends with a discussion of potential solutions to problems with performance in incident response.

A Model for Afghanistan’s Cyber Security Incident Response Team

“…8) Knowledge Sharing (guidance, advisories): 3C-CSIRT shares technical guidance and advisories that form a precautionary step for the constituency's systems or networks from cyber intrusion activities. A CSIRT is not something like operating in a vacuum, but it must operate in the context of a complex sociotechnical environment or system [9]. Therefore, 3C-CSIRT should share its practical experience regarding cyber incidents, vulnerabilities or other security issues with its constituencies as well as with other external CSIRTs, either locally or internationally, for better cooperation and coordination.…”

“…Therefore, 3C-CSIRT should share its practical experience regarding cyber incidents, vulnerabilities or other security issues with its constituencies as well as with other external CSIRTs, either locally or internationally, for better cooperation and coordination. However, sharing or exchanging information and cooperation depends on the available trust models they may have with each other [9]. 9) Security Related Information Dissemination:3C-CSIRT has a website through which all the constituencies can share security-related information such as recommended tools, security patches, software updates, best practices, vulnerabilities, and incidents in English as well as in their native language for better understanding.…”

“…Bradshaw [8] classify CSIRT based on the Parent organization such as National CSIRTs, Private CSIRTs, and Technical or Academic CSIRTs. According to [9] no two CSIRTs are the same. There are some similarities and differences exist in the CSIRTs.…”

Producing ‘good enough’ automated transcripts securely: Extending Bokhove and Downey (2018) to address security concerns

“…I am interviewing others who perform my role, as well as senior leaders within those organisations, using semi-structured interviews to inquire into any differences in perception and expectations as well as motivations and contexts. As semi-structured interviewing has become established as a core, and arguably the default, qualitative data-gathering method across the social sciences, for example, Coronel et al (2011) and Rainford (2020), and related disciplines, including business, for example, Maznevski and Chudoba (2000) and Peterson (2004), and cyber-security, for example, Ashenden and Sasse (2013), Singh et al (2013) and Van der Kleij et al (2017), researchers, like myself, that gather data using this method are faced with the task of preparing that data for analysis. For novice researchers, in particular, the predominant guidance from the literature, for example, Hammersley and Atkinson (1995) and Bryman (2012: 482) is for manual, verbatim (Seale, 2000: 148) transcriptions of audio-recorded interviews to be prepared in 'orthographic' (Braun and Clarke, 2006: 88) form for subsequent analysis, despite the acknowledged limitations of transcripts themselves (DeVault, 1990;Green et al, 1997;Lapadat and Lindsay, 1999;ten Have, 1990).…”

Text Mining in Cybersecurity: Exploring Threats and Opportunities

“…At the same time, rapid changes in security threat landscapes cause uncertainty for business continuity and may force changes to organizations' security strategy [8]. A solution is to automate the handwork or to provide forecasting analysts with proper decision support tools that could help reduce ambiguity or even predict future developments (see also [8,10]). There have already been extensive efforts in government, academia, and industry to do so [11].…”