Computer Security Incident Response Research Articles

Operational cyber incident coordination revisited: providing cyber situational awareness across organizations and countries

ABSTRACT Cyber situational awareness (CSA) is a prerequisite for justified decision-making and to maintain cyber security. This becomes particularly complex when establishing inter-organizational awareness across sectors. For example, computer security incident response teams (CSIRTs) and national cyber security centers need to establish CSA among countries when coordinating regional cyber incident response. Today’s state of the art of information sharing across larger numbers of organizations is often still the least common denominator in the shape of web-based forms and email reports. These are easily applicable by almost everyone who wants to report findings even in stressful situations. However, these do not prove to be efficient for the coordinator that aggregates and merges the data. Therefore, a cyber coordination platform using online surveys is proposed. This approach uses surveys to collect, aggregate and visualize data in a dashboard to support cyber coordination and knowledge management. Furthermore, the online surveys are easy to use and respond to and therefore simplify the participation of stakeholders. We propose an architecture and implement a prototype using popular web application frameworks. The evaluation in a user study revealed promising results with respect to increased efficiency and decreased resource requirements for establishing situational awareness.

Analysis of Knowledge Management Strategies for Handling Cyber Attacks with the Computer Security Incident Response Team (CSIRT) in the Indonesian Aviation Sector

Cyber attacks are one of the genuine threats that have emerged due to the evolution of a more dynamic and complex global strategic environment. In Indonesia, several cyber attacks target various government infrastructure sectors. The National Cyber and Crypto Agency (BSSN) predicts Indonesia will face approximately 370.02 million cyber attacks in 2022. The majority of cyber attacks target the government administration sector. The National Cyber and Crypto Agency (BSSN) officially formed a Computer Security Incident Response Team (CSIRT) to tackle the rampant cybercrime cases. CSIRT is an organization or team that provides services and support to prevent, handle, and respond to computer security incidents. The current CSIRT does not have a data storage process and forensic preparation. CSIRT will repeat the procedure, and so on. This is a repeating procedure; the attack will occur once, and only a technical problem will arise. Therefore, the research entitled "Analysis of Knowledge Management Strategies for Handling Cyber Attacks with the Computer Security Incident Response Team (CSIRT)" is expected to implement this Knowledge Management Strategy to manage existing knowledge so that it can make it easier for the CSIRT team to handle cyber attacks that occur.

Understanding How National CSIRTs Evaluate Cyber Incident Response Tools and Data: Findings from Focus Group Discussions

National Computer Security Incident Response Teams (CSIRTs) have been established worldwide to coordinate responses to computer security incidents at the national level. While it is known that national CSIRTs routinely use different types of tools and data from various sources in their cyber incident investigations, limited studies are available about how national CSIRTs evaluate and choose which tools and data to use for incident response. Such an evaluation is important to ensure that these tools and data are of good quality and, consequently, help to increase the effectiveness of the incident response process and the quality of incident response investigations. Seven online focus group discussions with 20 participants (all staff members) from 15 national CSIRTs across Africa, Asia Pacific, Europe, and North and South America were carried out to address this gap. Results from the focus groups led to four significant findings: (1) there is a confirmed need for a systematic evaluation of tools and data used in national CSIRTs, (2) there is a lack of a generally accepted standard procedure for evaluating tools and data in national CSIRTs, (3) there is a general agreement among all focus group participants regarding the challenges that impinge a systematic evaluation of tools and data by national CSIRTs, and (4) we identified a list of candidate criteria that can help inform the design of a standard procedure for evaluating tools and data by national CSIRTs. Based on our findings, we call on the cyber security community and national CSIRTs to develop standard procedures and criteria for evaluating tools and data that CSIRTs, in general, can use.

Vulnerability of South African Commodity Value Chains to Cyber Incidents

A commodity value chain can be considered the ‘route’ from the source (provider) to the destination (client), including the various modes of transportation. This will often include some form of road or rail to a port for export to a destination country. Due to the rise in cybercrime and state-backed cyber operations, these commodity value chains may be disrupted, having a cascading effect down the value chain. Previous research has considered this a form of economic information warfare, and has indicated that state-sponsored cyber operations to disrupt a commodity intentionally will most likely fall below the threshold of a ‘use of force’ or ‘attack’ under international law. Subsequently, two pertinent instances of cyber incidents at ports have occurred: the disruption of a major Iranian port, and a ransomware incident at a major South African freight and logistics state-owned enterprise. Following the disruption resulting from the ransomware incident affecting South African freight organisations, there is a need to analyse the vulnerabilities of the freight transportation sector further, in particular the ports and associated railways in terms of malicious cyber interference. Expanding previous research, this article provides a specific view of the major commodity value chains in South Africa that are supported by the freight transportation infrastructure, their possible vulnerability to cyber incidents, and the potential implications thereof. In addition, publicly available information on the responses to the ransomware incident will be discussed to gauge national readiness in terms of crisis management of a major disruption to the primary trade mechanisms in the country. The article focuses on identifying single points of failure within the commodity value chain, and employs hypothetical scenarios to illustrate possible ramifications of a major incident. The port of Durban is shown to the most critical single point of failure overall. Recommendations include the introduction of a sector-specific computer security incident response team for the freight transportation sector.

Collaboration of ministries/institutions and the private sector in handling cyber threats through the establishment of Computer Security Incident Response Team (CSIRT)

The writing of this article aims to describe how the coordination efforts of Ministries / Institutions and the Private Sector in handling cyber threats through the formation of a Computer Securtiy Incident Response Team (CSIRT). The research method used is a qualitative method through the study of literature from various reference sources and other documents. The writing of this article is descriptive and explanatory to obtain facts and describe a comparative analysis of cyber threat handling policies through CSIRT in various countries with Indonesia. The secondary data used are obtained not from direct observation but rather obtained from several previous studies such as research reports and other important documents. The result of this research is how collaboration is carried out by Ministries/Institutions and the Private Sector in handling cyber threats through the formation of a Cyber Incident Response Team organization.

Computer security incident response teams: are they legally regulated? The Swiss example

Computer Security Incident Response Teams (CSIRTs) or Computer Emergency Response Teams (CERTs) are an integral part of incident handling capabilities and are increasingly demanded by organizations such as critical infrastructures. They can hold many different skills and are of great interest to organizations in terms of cyber security and, more concretely, cyber incident management. This contribution seeks to analyze the extent to which their activity is regulated under Swiss law, considering that private CSIRTs are not regulated in the same way as governmental and national CSIRTs such as the Computer Emergency Response Team of the Swiss government and official national CERT of Switzerland (GovCERT).

Improving cybersecurity incidents reporting in Nigeria: micro and small enterprises perspectives

Leveraging on the provisions of the internet enhances the productivity of Micro and Small Enterprises (MSEs), increases industrial growth and their contributions to national prosperity. Every cyber-attack against their businesses should be reported to the requisite incident response body through the appropriate channels for quick recovery from attack. This research examines how the MSEs in Nigeria report cybersecurity incidents. This study surveyed 100 MSEs. The outcome of the research shows that 72% of the MSEs is unaware of the channel of reporting cyber incidents and does not report cyber incidents. Participants totaling 90% believe that the Sectoral Computer Security Incident Response Team (CSIRT) could improve on reporting of cybersecurity incidents through sensitisation. Amongst others, we recommended the Sectoral CSIRTs were to develop an Incident Report and Response Plan (IRRP) for managing cybersecurity incidents in MSEs.

Preliminary review of cybersecurity coordination in Nigeria

Cyberspace presents significant opportunities that enhance communication, and boost business and socio-economic prosperity in Nigeria. While cyber criminals thrive to exploit any vulnerability for their gains, the Nigeria Government has taken some measures to safeguard its cyberspace. This study evaluates the efforts of the Nigeria Government in the coordination of cybersecurity in the country. It used secondary source methodology by reviewing previous and related research works including books, articles among others. The study found that Nigeria has established a national Computer Emergency Response Team (CERT) and four active Sectoral Computer Security Incident Response Teams (CSIRTs). It also revealed that the Nigeria Government through the Office of the National Security Adviser (ONSA) formulated the National Cybersecurity Policy and Strategy (NCPS). It was found that the establishment of the National Cybersecurity Coordination Centre (NCCC) would enhance the implementation of cybersecurity programs in Nigeria. Amongst others, the study recommended that the ONSA should facilitate the approval for the establishment of NCCC.

PROTECTION OF CYBERSPACE IN POLAND AND THE CZECH REPUBLIC – THE ROLE OF SECRET SERVICES

Secret services are the key elements in the field of cyber security in Poland. Two of the national CSIRTs (Computer Security Incident Response Teams), i.e. CSIRT GOV and CSIRT MON are run by the following services: the Internal Security Agency and Military Counterintelligence Service. In the Czech Republic, CSIRTs/CERTs at the national level are operated by civilian entities and coordination in the event of a threat is the responsibility of the civilian National Cyber and Information Security Agency (NUKIB). The Polish Act on the National Cyber Security System does not provide for parliamentary control of the activities of national CSIRTs. In the Czech Republic, a special standing committee was established to control the activities of NUKIB. Fundamental differences in the structure of the cyberspace protection system in Poland and the Czech Republic may result from the adoption of different priorities in terms of values by political actors.

Inspecting current cybersecurity status and new trends in Hungary

In the 21st century online services became standard way to handle our affairs every day. The digital revolution and usage of smart devices made possible the existence of new type of cybersecurity threats. The malware distribution and their impact are constantly changing. The primary goal of cybersecurity attacks is catching sensitive data and business benefit. Instead of hobby hacking well organized cybercrime groups carry out the most offense. Computer Security Incident Response Teams (CSIRTs) must handle security incidents for e-Government information systems appropriately. This is extremely important if we want to mitigate the impact of a cybersecurity threat.
 In this paper, I will examine the available statistical data and reports of Government Incident Response Team of Hungary. Analyzing this information will point out what are the new trends of threats and malware. This paper also presents the findings gained from processed data.

Mitigating Global Cyber Risk Through Bridging the National Incident Response Capacity Gap

Cyber-attacks know no borders. Given the globally connected environment, no region or country is secure against cyber-attacks unless the entire world is secure or has cyber capabilities. Yet, whether preventive or reactive, cyber countermeasures require coordination and engagement of various organizations, government bodies, and citizens of different countries. Although a variety of countermeasures exist, Computer Security Incident Response Teams (CSIRTs) have been deemed necessary systems in defending against and preventing cyberattacks, further supporting a nation’s cyber capacity and limiting the harm to citizens, businesses, and governments. Despite calls for establishing CSIRTs at the national level, especially toward protecting critical infrastructure and lives from cyber threats, various discrepancies exist based on a nation’s resources, capabilities, and needs. Limited research delves into the cyber capabilities of low-income countries despite an emphasis on improving global cyber capacity, leading to a need to establish a framework for low-income countries to address the unique needs with lessons learned from existing standards. CSIRTs can improve the cybersecurity posture of countries, so we seek to investigate how low-income countries can better mitigate cyber threats through cyber capacity building, including the creation of CSIRTs. This work-in-progress paper aims to investigate cyber incident response capacity building at the national level in low-income countries and identify challenges they may face in contributing to a more secure global cyberspace. Stemming from this paper, we will conduct a survey of national CSIRTs in low-income countries and conduct semi-structured interviews to further investigate their role. The implications of our research are far-spreading, assisting academics, practitioners, and governments in developing research, processes, and policies to aid low-income countries in their national cyber capacity building.

Knowledge Management Strategy for Handling Cyber Attacks in E-Commerce with Computer Security Incident Response Team (CSIRT)

Electronic Commerce (E-Commerce) was created to help expand the market share network through the internet without the boundaries of space and time. However, behind all the benefits obtained, E-Commerce also raises the issue of consumer concerns about the responsibility for personal data that has been recorded and collected by E-Commerce companies. The personal data is in the form of consumer identity names, passwords, debit and credit card numbers, conversations in email, as well as information related to consumer requests. In Indonesia, cyber attacks have occurred several times against 3 major E-Commerce companies in Indonesia. In 2019, users’ personal data in the form of email addresses, telephone numbers, and residential addresses were sold on the deep web at Bukalapak and Tokopedia. Even though E-Commerce affected by the cyber attack already has a Computer Security Incident Response Team (CSIRT) by recruiting various security engineers, both defense and attack, this system still has a weakness, namely that the CSIRT operates in the aspect of handling and experimenting with defense, not yet on how to store data and prepare for forensics. CSIRT will do the same thing again, and so on. This is called an iterative procedure, one day the attack will come back and only be done with technical handling. Previous research has succeeded in revealing that organizations that have Knowledge Management (KM), the organization has succeeded in reducing costs up to four times from the original without using KM in the cyber security operations. The author provides a solution to create a knowledge management strategy for handling cyber incidents in CSIRT E-Commerce in Indonesia. This research resulted in 4 KM Processes and 2 KM Enablers which were then translated into concrete actions. The KM Processes are Knowledge Creation, Knowledge Storing, Knowledge Sharing, and Knowledge Utilizing. While the KM Enabler is Technology Infrastructure and People Competency.

Proposal for an Implementation Guide for a Computer Security Incident Response Team on a University Campus

Currently, society is going through a health event with devastating results. In their desire to control the 2019 coronavirus disease, large organizations have turned over the execution of their activities to the use of information technology. These tools, adapted to the use of the Internet, have been presented as an effective solution to the measures implemented by the majority of nations where quarantines are generalized. However, the solution given by information technologies has several disadvantages that must be solved. The most important in this regard is with the serious security incidents that exist, where many organizations have been compromised and their data has been exposed. As a solution, this work proposes the design of a guide that allows for the implementation of a computer incident response team on a university campus. Universities are optimal environments for the generation of new technologies; they also serve as the ideal test bed for the generation of security policies and new treatments for incidents in an organization. In addition, with the implementation of the computer incident response team in a university, it is proposed to be part of a response group to any security incident at the national level.

The Networked Politics of Cybersecurity: Co-Production and Tensions around Incident Response.

Computer systems, networks and infrastructures are the foundation of a digitally connected society. They are managed and maintained by a diverse and transnational group of actors. While many cybersecurity scholars have focused on the role of states and private companies in the ‘making of cyber-security’, such emphases tend to obfuscate the plethora of practices, understandings and communities across the public-private continuum that are engaged in identifying, handling, and responding to incidents and threats. Historically, incident response has been continually associated with the role of CERTs or Computer Security Incident Response Teams (CSIRTs) – an organisation that operates as a focal point to the identification, reporting and handling of cyber incidents. These so-called — yet often-unseen —‘digital fire brigades’ or ’first responders’ (Skierka et al. 2015) possess specific communicational designs (e.g.: informal networks based on interpersonal relationships, protocols such as Common Vulnerability Scoring System and others) and jointly comprise a global network of information sharing and cooperation. However, as a practice, incident response remains perennial to the functioning of any interconnected system and infrastructure, often taking different institutional forms across public and private institutions. In addition, incident response also signifies the operation of many communities working on conducting these routine activities that are focused on the repair, maintenance, improvement and measurement/classification of cybersecurity incidents that may or may not be under a CERTs or CSIRTs. In general terms, incident response predates institutionalised forms of ‘teams’. From a system administrator monitoring networks in an institution to more offensive-facing teams such as Security Operation Centres (SOC), different communities engage in incident response. Teams have taken distinct shapes and forms in response to numerous factors that include but are not restricted to business incentives for threat-detection and more ‘active’ approaches, national cybersecurity concerns, and acceptance of widespread discourses around the lack of professional capacities as an inherent condition to contemporary cybersecurity challenges (Shires, 2018). The politics of change in incident response practices do not occur in a vaccum, rather they are co-produced (Jasanoff, 2004) in a landscape where cybersecurity has become the object of dispute in geopolitical battles, regulatory agendas, business solutions, among other areas. These changes are often enunciated in official speeches from heads of state, crystallized in government and business reports, and stabilized through the development of tools, manuals and standards that suggest new ways for conducting ‘response’. From G7 2021 declaration mentioning responsible state behaviour in cyberspace to cybersecurity manuals, incident response is a key function for coordination, resilience, and stability of cyberspace. Understanding and exploring the spectrum of political challenges reconfiguring incident response can therefore aid in better-capturing challenges in coordination and the fragmentation of efforts to respond to cyber threats. What is more, it provides a perspective of how particular representations of incident response are crystallized and the consequences that has to cybersecurity governance. So, while incident response is networked as a practice, we explore the tensions that arise in networking processes. Based on document analysis of CSIRT manuals, cybersecurity regulations and policies, and incident response literature, the paper looks at three areas where these tensions arise: professional development, regulatory advances, and geopolitical disputes. Each of these areas provides an important insight into the ways in which ‘response’ is prescribed, stabilised and networked in emergent ways – and the consequences they bring to the politics of cybersecurity. The paper is divided into three parts. First, we explore some of the factors that are shaping how incident response is practised and understood, and why this matters for understanding new configurations of cybersecurity politics. Second, the paper analyses the different ways in which incident response has been institutionalised and the impact that has to shifting the actors and practices that integrate ‘incident response’. Third, we discuss some of the ‘pressure points’ that have been contesting and reshaping the supposed borders of how and who should be involved in ‘response’.

Methodology for Computer Security Incident Response Teams into IoT Strategy

At present, the Colombian government shares information on threats or vulnerabilities in the area of cybersecurity and cyberdefense, from other government agencies or departments, on an ad-hoc basis but not in real time, with the surveillance entities of the Government of the Republic of Colombia such as the Joint Command of Cybernetic Operations (CCOCI) and the Cybernetic Emergencies Response Team of Colombia (ColCERT). This research presents the MS-CSIRT (Management System Computer Security Incident Response Teams) methodology, that is used to unify the guidelines of a CSIRT towards a joint communication command in cybersecurity for the surveillance of Information Technology (IT), Technological Operations (TO), Internet Connection Sharing (ICS) or Internet of Things (IoT) infrastructures. This methodology evaluates the level of maturity, by means of a roadmap, to establish a CSIRT as a reference framework for government entities and as a guide for the areas of information security, IT and TO to strengthen the growth of the industry 4.0. This allows the organizations to draw a line of cybersecurity policy with scope, objectives, controls, metrics, procedures and use cases for the correct coordination between ColCERT and CCOCI, as support entities in cybersecurity, and the different companies (ICS, IoT, gas and energy, mining, maritime, agro-industrial, among others) or government agencies that use this methodology.

Review of Human Decision-making during Computer Security Incident Analysis

We review practical advice on decision-making during computer security incident response. Scope includes standards from the IETF, ISO, FIRST, and the US intelligence community. To focus on human decision-making, the scope is the evidence collection, analysis, and reporting phases of response, which includes human decision-making within and connecting these phases. The results indicate both strengths and gaps. A strength is available advice on how to accomplish many specific tasks. However, there is little guidance on how to prioritize tasks in limited time or how to interpret, generalize, and convincingly report results. Future work should focus on these gaps in explication and specification of decision-making during incident analysis.

The Importance of the Three P's in the Investigation

This article introduces the importance of process during the investigation and the acquisition phases of logical/physical artifacts which may be required during the course of such professional engagement. The article then focuses on the necessity to have a robust supportive framework in a state of preparedness to facilitate the First Responders and CSIRT (Computer Security Incident Response Team) with the necessary underpin to support such investigative engagements – considering effective and pragmatic Policies, Case Management, operational Security Protocols (Run-Books) and all other necessary attributes to underpin a professional, prepared posture from which a team may effectively, and robustly engage an investigation/incident. To elaborate on the importance of such an approach, we outline a number of real-world cases where ineffective processes and controls were applied. Finally, we review the essential elements of securely managing case-related data, and the absolute need to apply security mechanisms such as Certified Standards of FIPS-140-2 encryption to secure sensitive case related assets to assure they are robustly protected at all stages of their life cycle when they are in physical transit, or when they are at rest, associated with a desk-bound PC. The end objective to the entire article is to stress an absolute need to apply process to, as far as is practicable, to achieve positive conclusions from any investigation or incident which has been engaged.

Distributed Security Framework for Reliable Threat Intelligence Sharing

Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.

Trusting Infrastructure: The Emergence of Computer Security Incident Response, 1989-2005.

Historians have tended to analyze maintenance as an intrinsically local activity, something very unlike the development of large technological systems. This article challenges this historiographic dichotomy by examining efforts to construct a global infrastructure for maintaining computer security. In the mid-1990s, as the internet rapidly grew, commercialized, and internationalized, a small community of computer security incident responders sought to scale up their system of coordination, which had been based on interpersonal trust, by developing trusted infrastructure that could facilitate the worldwide coordination of incident response work. This entailed developing not only professional standards, but also institutions for embodying and maintaining those standards in working infrastructure. While some elements of this infrastructure became truly global, others remained regionally bounded. We argue that this boundedness resulted not from the intrinsically local nature of maintenance, but from the historical process of infrastructure development, which was shaped by regionally based trust networks, institutions, and needs.

Observing Cyber Security Incident Response: Qualitative Themes From Field Research

Cyber security increasingly focuses on the challenges faced by network defenders. Cultural and security-driven sentiments about external observation, as well as publication concerns, limit the ability of researchers to understand the context surrounding incident response. Context awareness is crucial to inform design and engineering. Furthermore, these perspectives can be heavily influenced by the targeted sector or industry of the research. Together, a lack of broad contextual understanding may be biasing approaches to improving operations, and driving faulty assumptions in cyber teams. A qualitative field study was conducted in three computer security incident response teams (CSIRTs) and included perspectives of government, academia, and private sector teams. Themes emerged and provide insights across multiple aspects of incident response, including information sharing, organization, learning, and automation. The need to focus on vertical integration of issues at different levels of the incident response system is also discussed. Future research will build upon these results, using them to inform technology advancement in CSIR settings.