An Engineering Process Framework for Cybersecurity Incident Response Assessment

Abstract

Recent incidents and continuous cyber attacks highlight that most currently adopted cybersecurity solutions and processes remain highly reactive, with short-lived remedies. The critical need for more proactive and mature response processes has never been more critical. We look at engineering and borrow concepts from mature systematic processes such as the engineering design process to develop a new framework for activer cyber incident response processes. Currently, cybersecurity incident response structure and processes are outlined in multiple frameworks including the MITRE ATT&CK framework, NIST's Cybersecurity framework, and the traditional incident response (IR) lifecycle. Using a blend of those frameworks and the concepts from the engineering design process we propose O2I that is more adept to a more proactive and sustainable security response. With proper implementation, O2I's iterative processes could provide a sustainable and adaptable approach to assess and improve cyber security response processes. To validate the benefits and feasibility of the proposed framework, we utilize it to evaluate recent attacks using publicly available information.