STORM - Collaborative Security Management Environment

Abstract

Abstract. Security Management is a necessary process in order to obtain an accurate security policy for Information and Communication Systems (ICS). Organizations spend a lot of money and time to implement their security policy. Existing risk assessment, business continuity and security management tools are unable to meet the growing needs of the current, distributed, complex IS and their critical data and services. Identifying these weaknesses and exploiting advanced open-source technologies and interactive software tools, we propose a secure, collaborative environment (STORM) for the security management of ICS's.

A Multi-Vocal Review of Security Orchestration

“…The lack of interoperability among security tools results in more responsibility on human experts (briefly explained in section 5.2) and leads to redundant, complex, inefficient incident response process. Existing security management and risk assessment solutions are not designed to collaborate [77]. These solutions do not consider several aspects that affect the evaluation criteria of the threats and vulnerabilities thus make the security procedures incomplete.…”

“…Learning. A set of studies have used Artificial Intelligence (AI) technique and game theory model to make security system intelligent [21,44,48,66,73,77]. McAfee has proposed to expand the security orchestration platform capabilities by including behavioral security; for example, pre-execution, postexecution, machine learning and more [12].…”

“…Most of the security orchestration platforms assume that organizations already own multivendor security tools. Several papers have mentioned a range of security tools while designing orchestration platform for small to the medium organizations [13,17,29,49,60,66,77,101,108]. Some key types of security tools used by organizations are SIEM, forensics tools, signature-based control tools, firewall, IDS/IPS, anti-malware, antivirus, perimeter security tools, ticketing solutions, traffic inspection tools, compliance tools and vulnerability scanners [43,108,115].…”

“…Zonouz et al [42] have mentioned an online evaluation framework to help administrators. For a coordination model, the work reported in [77] has proposed four groups of users where they have considered security and business continuity team as a group and administrator as another group. The other two groups are a group of local users and group of external or corporate users [77].…”

“…For a coordination model, the work reported in [77] has proposed four groups of users where they have considered security and business continuity team as a group and administrator as another group. The other two groups are a group of local users and group of external or corporate users [77]. Security teams vary by size, vertical and expertise and what an organization needs from threat intelligence [86].…”