SPINZ: A Speculating Incident Zone Systemfor Incident Handling

Abstract

Organizations introducing computer and network systems need to quickly and accurately respond to information security incidents to counter intense cyber attacks. However, computer security incident response teams (CSIRTs) in organizations receive a large amount of alerts and logs that they have to investigate. Such a situation increases incident handling time. Our previous research revealed that the triage process in incident handling failed in many incident cases. In our consideration, the triage process lacks the ability to assess overall risks to modern cyber attacks. Zoning of local area networks by measuring internal-network traffic in response to such risks is important. Therefore, we propose the SPeculating INcident Zone (SPINZ) system for supporting the triage process. The SPINZ system analyzes internal-network flows and outputs an incident zone, which is composed of devices related to the incident. We evaluated the performance of the SPINZ system through simulations using two incident-flow dataset generated from two types of internal-network datasets and malicious-activity flows generated from legitimate commands. We confirm that the SPINZ system can detect an incident zone, but removing unrelated devices from an incident zone is an issue requiring further investigated.

Eksplorasi Implementasi Kebijakan Pembentukan Computer Security Incident Response Team (Csirt) di Kementerian Perdagangan: Sebuah Studi Kualitatif

“…Oleh karena itu CSIRT Kementerian Perdagangan mengemban visi menciptakan keamanan siber yang handal dan terampil di lingkungan Kementerian Perdagangan (Preuveneers, Joosen, Bernal Bernabe, & Skarmeta, 2020). Di samping itu, pembentukan Tim ini juga bertujuan untuk mengkoordinasikan, bekerja sama, dan mengurangi risiko serta memulihkan keamanan siber dengan pihak-pihak publik, privat dan lembaga insiden siber di Indonesia, dan juga bertekad untuk meningkatkan kesadaran dan kualitas layanan TIK di Kementerian Perdagangan atas ancaman siber (Hasumi, Shima, & Takakura, 2019).…”