Preparation, detection, and analysis: the diagnostic work of IT security incident response

Abstract

Purpose -The purpose of this paper is to examine security incident response practices of information technology (IT) security practitioners as a diagnostic work process, including the preparation phase, detection, and analysis of anomalies. Design/methodology/approach -The data set consisted of 16 semi-structured interviews with IT security practitioners from seven organizational types (e.g. academic, government, and private). The interviews were analyzed using qualitative description with constant comparison and inductive analysis of the data to analyze diagnostic work during security incident response. Findings -The analysis shows that security incident response is a highly collaborative activity, which may involve practitioners developing their own tools to perform specific tasks. The results also show that diagnosis during incident response is complicated by practitioners' need to rely on tacit knowledge, as well as usability issues with security tools. Research limitations/implications -Owing to the nature of semi-structured interviews, not all participants discussed security incident response at the same level of detail. More data are required to generalize and refine the findings. Originality/value -The contribution of the work is twofold. First, using empirical data, the paper analyzes and describes the tasks, skills, strategies, and tools that security practitioners use to diagnose security incidents. The findings enhance the research community's understanding of the diagnostic work during security incident response. Second, the paper identifies opportunities for future research directions related to improving security tools.

Enhancing security incident response follow-up efforts with lightweight agile retrospectives

“…It is also worth noting that in one retrospective, one of the SIHs indicated that the reason why they could not investigate the contents of the Windows Registry was due to limited tool access. This supports previous findings that individuals within security incident response, often need specialized tools and/or they have to develop their own tools to perform specific exploratory tasks (Werlinger et al, 2010).…”

“…Grimes (2007) argued that traditional security incident response models have become outdated and are no longer suited to manage today's security incidents. Werlinger et al (2010), add that current security incident response tools do not appropriately support the highly collaborative nature of security investigations and that incident handlers often need to develop their own tools to perform specific tasks. Tan et al (2003) explored the factors that influenced information security managers to avoid conducting investigations subsequent to a security incident.…”

Zebras and Lions: Better Incident Handling Through Improved Cooperation

“…This is disturbing since incident management is collaborative in nature. This is exemplified by Werlinger et al [8], who found that:…”

“…Werlinger et al [8] studied the practices related to diagnostic works during incident response in a variety of organizations. Ahmad et al [9] studied incident management in a large financial institution, and Jaatun et al [7] studied incident response in the petroleum industry.…”

Corporate Role in Protecting Consumers from the Risk of Identity Theft

“…The response team evaluates attack data against policies, determine that type and nature of attack and formulate a response within the acceptable reaction time [29]. Effective response to DOS and DDOS are early detection, coordinated cooperation between network domains to exchange information without impacting network support payload [30].…”