SOTER: A Playbook for Cybersecurity Incident Management

Abstract

SOTER 1 , a cyber security incident management playbook, is developed to provide a comprehensive model to manage cyber security incidents, particularly for the cyber security operations centre. The proposed playbook is adaptive, cross-sectorial, and process driven. Each key components of the incident management playbook are outlined and discussed. Further, a lexicon based on equivalence mapping is developed and used to map existing cyber security incident vocabulary and taxonomy into a common and consistent lexicon to aid understanding among incident management stakeholder communitiesnational, government and private sectors. A versatile workbook model has been explored which proves to be adaptable to serve a wide range of cases for successfully managing government and private sector security operations centre.Cyber security incident sharing partnership, formalism for metric and measurements of cyber security incident parameters, and cyber security incident classification and prioritisation schemes are presented, and finally, cyber security incident 'plays' and playbook templates are discussed.

Understanding decision making in security operations centres: building the case for cyber deception technology

“…The above literature review provided context to frame our research questions when interviewing experts on the challenges facing contemporary SOCs. Studies such as Alahmadi et al (2022) and Onwubiko and Ouazzane (2022) have shown that the high rate of false positive alarms produced by security tools is an operational challenge for SOC analysts, and it is unclear how cyber deception would influence this false positive rate. Additionally, research such as Cho et al (2020) has shown that tacit knowledge plays a crucial role in the decision-making processes of SOC analysts, and that simulations and physical proximity with analysts and vendors can facilitate the transfer of this knowledge.…”

Threat Actors’ Tenacity to Disrupt: Examination of Major Cybersecurity Incidents

“…Prior to the occurrence of a significant security attack or during active cybersecurity incident investigation, having the necessary information sharing strategy in place and effectively executing such strategy is very important for ensuring that all parties are kept informed in the prior, during, and post stages of any given cybersecurity incident handling [65], [66], [67], [64], [68], [69]. "Information about threats can improve an organization's situational awareness, expand its understanding of the current threat horizon and increase its defensive agility by improving decision making" [64].…”

A Comparative Study on Cyber Threat Intelligence: The Security Incident Response Perspective

“…18) Prioritization: Not all incident response information must be treated equal. As there are severe and less severe security incidents the prioritization concept is relevant for incident response formats [99]. In general, prioritization expresses the urgency of incident response execution relative to other incident response procedures.…”