Enhancing security incident response follow-up efforts with lightweight agile retrospectives

Abstract

Security incidents detected by organizations are escalating in both scale and complexity. As a result, security incident response has become a critical mechanism for organizations in an effort to minimize the damage from security incidents. The final phase within many security incident response approaches is the feedback/follow-up phase. It is within this phase that an organization is expected to use information collected during an investigation in order to learn from an incident, improve its security incident response process and positively impact the wider security environment. However, recent research and security incident reports argue that organizations find it difficult to learn from incidents.A contributing factor to this learning deficiency is that industry focused security incident response approaches, typically, provide very little practical information about tools or techniques that can be used to extract lessons learned from an investigation. As a result, organizations focus on improving technical security controls and not examining or reassessing the effectiveness or efficiency of internal policies and procedures. An additional hindrance, to encouraging improvement assessments, is the absence of tools and/or techniques that organizations can implement to evaluate the impact of implemented enhancements in the wider organization. Hence, this research investigates the integration of lightweight agile retrospectives and meta-retrospectives, in a security incident response process, to enhance feedback and/or follow-up efforts. The research contribution of this paper is twofold. First, it presents an approach based on lightweight retrospectives as a means of enhancing security incident response follow-up efforts. Second, it presents an empirical evaluation of this lightweight approach in a Fortune 500 Financial organization's security incident response team.

Security Assurance Modelling of Security Incident in Healthcare using the Generic Security Template (GST)

“…Healthcare Incident Learning Incident learning happens in the "follow-up" phase of the incident response process [21]. This information should feed relevant knowledge and changes into the security management process to inform the creation of further reference material on how to respond to similar incidents [21,36,37]. In particular, such activities feed information back to the "preparedness" phase to determine if additional tools, increased security budgets, improved training programs and alterations to the incident response procedures are required.…”

Network Attack Detection Using an Unsupervised Machine Learning Algorithm

“…The rise in internet users appears to correlate with an escalation in cyber-crimes, which creates a risk for the organization's information security [2]. Detecting and responding to security incidents interest both industry and academicians [3][4][5][6]. According to a report by Forrester's, government, retail, and technology industries constituted 95% of the breached records in 2016, which included personal identifying information [7].…”

Insight from a Docker Container Introspection

“…The evolving atmosphere in cloud computing encourages organizations to consider cloud environments from a security perspective along with ways to improve incident response situations [24][25][26][27]. Trends in adoption of containers and increasing security prompts the hypothesis that introspection tools can be used as a data collection tool for an early warning system, as well as a forensic analysis tool, within a containerized system.…”