“it's a generally exhausting field” A Large-Scale Study of Security Incident Management Workflows and Pain Points

Abstract

Security incident management is of increasing importance given the growth in cybersecurity threats and regulatory attention. We provide what is, to the best of our knowledge, the first large-scale study of security incident management, consisting of a survey with more than 500 security incident management practitioners grounded by interviews with practitioners in 10 organizations, including companies and educational institutions. We find that some aspects of incident management workftows are consistent across organizations and incident management teams (e.g., collaboration and prioritization), but that the complexity of incident management generally grows with organization size, in that practitioners encounter a wider variety and volume of incidents, collaboration partners and tools. These variations suggest several ways in which tools can better support efficient incident management.