How Good is Your Data? Investigating the Quality of Data Generated During Security Incident Response Investigations

Abstract

An increasing number of cybersecurity incidents prompts organizations to explore alternative security solutions, such as threat intelligence programs. For such programs to succeed, data needs to be collected, validated, and recorded in relevant datastores. One potential source supplying these datastores is an organization's security incident response team. However, researchers have argued that these teams focus more on eradication and recovery and less on providing feedback to enhance organizational security. This prompts the idea that data collected during security incident investigations may be of insufficient quality for threat intelligence analysis.While previous discussions focus on data quality issues from threat intelligence sharing perspectives, minimal research examines the data generated during incident response investigations. This paper presents the results of a case study identifying data quality challenges in a Fortune 500 organization's incident response team. Furthermore, the paper provides the foundation for future research regarding data quality concerns in security incident response.

ARIMA Supplemented Security Metrics for Quality Assurance and Situational Awareness

“…A significant number of research contributions, which include Grispos et al [16], Meier et al [25], and Sillaber et al [32], underline the importance of quality assurance and control for threat intelligence applications. In addition, Li et al [22] and Pinto and Sieira [28] successfully apply security metrics to measure quality criteria of common feeds of threat intelligence data.…”

On the Assessment of Completeness and Timeliness of Actionable Cyber Threat Intelligence Artefacts

“…As a result of that research they presented various findings and recommendations regarding threat intelligence data quality. The authors of [14], focused on the topic of quality of data generated by incident response teams during investigations. Their methodology was based on a case study within a financial organization to empirically evaluate data quality.…”

Deception Detection Using Machine Learning

“…These fraudulent communications constitute a security incident depending on the outcome of associated activities. Academic and industrial publications continue to indicate that security incidents plague organizations; that incident recognition is critical to response scenarios and that these issues continue to have a financial and legal impact on organizations [2][3][4][5][6][7][8][9][10]. Malicious forms of communication that organizations deal with range from phishing attacks, to bogus customer reviews, to fake news.…”