Cybersecurity Incident Response Research Articles

Incident Response Simulation Framework

Incident response is a pivotal security role in organizations that aimed to manage incidents quickly and economically. Cybersecurity Incident Response is a valuable development in the mitigation and operational security and data protection methods to safeguard employees and their assets. Cybersecurity awareness training is a powerful approach that leverage companies to cultivate employees into developing their knowledge and awareness of best practices and strategies for safeguarding sensitive data. Incident response is an emerging field due to the exceptional rise in the security breaches. The organizations need to implement such incident responses for the data breaches. The operational teams should be equipped with the hands-on experience of the incidents. The real-world scenarios must be used as a method to enhance the knowledge of the security team. The proposed system responds to such security demands generating an environment to test the security architecture, measure, track and report Cybersecurity KPIs as overall threat exposure to reduce exposure risk. The system is an educative framework for giving a real-world experience to the users and also test their ability and agility to respond to the incidents in the given time and correctly. Keywords—Incident response, Cybersecurity, data breaches, security

Burnout in Cybersecurity Incident Responders: Exploring the Factors that Light the Fire

As concerns about employee burnout and skilled staff shortages in cybersecurity grow, our study aims to better understand the contributing factors to burnout in this field. Utilizing a mixed-methods approach, we analyze self-reported job and personal characteristics, along with digital activity data from 35 incident responders, identifying several factors such as high workload, time pressure, and lack of support from management. Our findings reveal that over half of the participants experience burnout (N=19), which is linked to increased workload, limited control, poor teamwork, and inadequate recognition. Burned-out responders often work more than 40 hours per week, have poor sleep quality, and engage in more email activities, meetings, and after-hour collaborations. Through our research, we also identify coping strategies individuals use to mitigate these stressors. Based on our findings, we provide practical recommendations to help organizations better support their cybersecurity incident response teams. While our study acknowledges limitations and suggests future research directions, it contributes significantly to understanding the challenges faced by cybersecurity incident responders. Our insights offer a comprehensive understanding of burnout factors in this domain and have broader implications for other high-stress work environments consistent with the interdisciplinary nature of CSCW.

Unscripted Practices for Uncertain Events: Organizational Problems in Cybersecurity Incident Management

Scripts can help us understand the designer–user relationship, by offering analysis of designers’ intent in technological objects and examination of users’ behaviors through willingness (and unwillingness) to take on scripts. But how are we to understand these relationships in the context of cybersecurity, in the face of adversaries determined to gain unauthorized access to computer systems by actively subverting scripts? In effect, cybersecurity attacks involve re-scripting of computing systems to gain unauthorized access through unscripted features of these systems. Cybersecurity attacks are always uncertain events: attackers can never be certain when re-scripting will be successful, and defenders can never be certain when or where to expect an attack, as unscripted features are difficult to know until they are exploited. In this paper, I study practices of cybersecurity incident response to examine how cybersecurity engineers respond to the novel attacks they encounter daily. I show how these are fundamentally unscripted practices emerging in response to unstable scripts, structured through the uncertainties inherent in cybersecurity engineering practice. The improvised practices and changing networks of social relations which I trace demonstrate the limits of stable scripts and provide new tools for analyzing unstable scripts.

Exploring Critical Vulnerabilities in SIEM Implementation and SOC Service Procurement: An In-Depth Analysis of High-Risk Scenarios

This research paper examines the high risks encountered while using a Security Information and Event Management (SIEM) product or acquiring Security Operations Center (SOC) services. The paper focuses on key challenges such as insufficient logging, the importance of live log retentions, scalability concerns, and the critical aspect of correlation within SIEM. It also emphasizes the significance of compliance with various standards and regulations, as well as industry best practices for effective cybersecurity incident detection, response, and management.

Moving towards agile cybersecurity incident response: A case study exploring the enabling role of big data analytics-embedded dynamic capabilities

Organizations are at risk of cyber-attacks more than ever before due to the ongoing digitalization of business operations. Industry reports indicate that it is not a matter of if but when organizations become victims of cyber-attacks or breaches. In this research, we argue that organizations must enable agility in their incident response (IR) to quickly respond to diverse cybersecurity threats, and big data analytics (BDA) plays a pivotal role in enabling agility in the IR. Drawing from dynamic capabilities theory, we conducted a field study using a case study approach to examine the following research question: What dimensions of big data analytics-embedded dynamic capabilities enable agility in cybersecurity incident response? We develop a framework that presents five key dimensions of BDA-embedded dynamic capabilities (data consolidation, threat intelligence, incident investigation, analytical skillset, and cybersecurity analytics warehouse) in IR at four specific stages, that is, manual analysis, basic analytics, advanced analytics, and pervasive analytics. The detail of the framework explains how BDA-embedded dynamic capabilities at the pervasive analytics stage enable agility in IR by infusing agile characteristics of flexibility, speed, and learning in IR. This study contributes to the knowledge of IT-embedded dynamic capabilities and cybersecurity IR agility. Detailed recommendations are also provided for potential practitioners.

The importance of practice for cyber security incident response

The importance of practice for cyber security incident response

Enabling cybersecurity incident response agility through dynamic capabilities: the role of real-time analytics

ABSTRACT We explore how organisations enable agility in their cybersecurity incident response (IR) process by developing dynamic capabilities using real-time analytics (RTA). Drawing on RTA practices in the IR process at three large financial organisations, we develop a framework to explain how IR teams respond to the rapidly evolving cyber threat environment by developing RTA-based microfoundations that underpin the building of sensing, seizing, and transforming dynamic IR capabilities. These dynamic IR capabilities in turn help organisations to enable agility in their IR processes by leveraging swift, flexible, and innovative IR strategies, including active threat reconnaissance, active threat defence, and pervasive learning. Our findings have implications for the discourse on cybersecurity because we demystify the black box of IR agility, for our understanding of the use of RTA to enable agility in IR, and for the discourse on dynamic capabilities.

Operations-informed incident response playbooks

Cyber security incident response playbooks are critical for establishing an effective incident response capability within organizations. We identify a significant conceptual gap in the current research and practice of cyber security playbook design: the lack of ability to communicate the operational impact of an incident and of incident response on an organization. In this paper, we present a mechanism to address the gap by introducing the operational context into an incident response playbook. This conceptual contribution calls for a shift from playbooks that consist only of process models to playbooks that consist of process models closely linked with a model of operations. We describe a novel approach to embed a model of operations into the incident response playbook and link it with the playbook's incident response activities. This allows to reflect, in an accurate and systematic way, the interdependencies and mutual influences of incident response activities on operations and vice versa. The approach includes the use of a new metric for evaluating the change in operations in coordination with critical thresholds, supporting decision-making during cyber security incident response. We demonstrate the application of the proposed approach to playbook design in the context of a ransomware attack incident response, using a newly developed open-source tool.

Maritime Education and Training (met) Cybersecurity and iso/iec 27001:2022 from Maritime Academy of Asia and the Pacific (maap) Perspectives and Traditions

The International Maritime Organization (IMO) has promoted the cybersecurity or maritime cyber risk management in raising awareness across the industry on how to tackle the extent to which a technology asset is threatened by a potential circumstance or event, which may result in shipping-related operational, safety or security failures brought about by information or systems being hacked, breached, or compromised. Survey says that among all industries, the education sector ranked as the least secured with 87% having experienced at least one attack. Hence, Cybersecurity for MET is indispensable for the protection of networks, devices, and data from unauthorized or unintended access or illegal use. This paper shall be using quantitative and quantitative methods of research. Fortunately, ISO has published ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection – Information security management systems – Requirements and MAAP has its Cybersecurity Incident Response Plan. This paper shall use a historical research method related to MAAP Cybersecurity traditions and perspectives to align with the new international standard.

A performance overview of machine learning-based defense strategies for advanced persistent threats in industrial control systems

Cybersecurity incident response is a very crucial part of the cybersecurity management system. Adversaries emerge and evolve with new cybersecurity tactics, techniques, and procedures (TTPs). It is essential to detect the TTPs in a timely manner to respond effectively and mitigate the vulnerabilities to secure business operations. This research focuses on TTP identification and detection based on a machine learning approach. Early identification and detection are paramount in protecting, responding to, and recovering from such adversarial attacks. Analyzing use cases is a critical tool to ensure proper and in-depth evaluation of sector-specific cybersecurity challenges. In this regard, this study investigates existing known methodologies for cyber-attacks such as Mitre attacks, and developed a method for identifying threat cases. In addition, Windows-based threat cases are implemented, comprehensive datasets are generated, and supervised machine learning models are applied to detect threats effectively and efficiently. Random forest outperforms other models with the highest accuracy of 99%. Future work can be done for generating threat cases based on multiple log sources, including network security and endpoint protection device, and achieve high accuracy by removing false positives using machine learning. Similarly, real-time threat detection is also envisioned for future work.

A Survey on National Cyber Emergency Plans

Operators of Essential services (OESs) and Critical infrastructures (CIs), whether private companies or public organizations are going through a digital transformation to pace with the evolution of technology and to bring better services to customers and countries’ citizens. Operational Technology (OT) systems like Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCS) used to control and monitor functions in such infrastructures are converging with Information Technology (IT) environments. This convergence has exposed infrastructures to new cyber risks. For this reason, EU Member States have been trying to build resilience against cyber-attacks to ensure the stable operation of their states. Several countries have established cybersecurity incident response procedures as well as steps or phases of response before, during, and after a cyber incident. The sum of these procedures and guidelines constitutes their national cyber emergency plans (NCEPs). Still, these NCEPs differ widely in their approaches. These differences manifest as both managerial, governmental, legal, and technical, creating a complex environment worldwide. In this paper, we gather four major NCEPs worldwide to analyze and compare them with prominent standards and industry guidelines in cybersecurity, like the ISO 27001 and NIST 800 series. We investigate NCEP approaches to building cyber resilience based on their response models, their involved entities, the cooperation between agencies and other countries, and their risk-based categorization for cyber incidents. We elaborate on their differences, potential issues and divergences and argue whether these plans can be combined to bridge potential weaknesses. We selected and surveyed four (4) cyber emergency plans from four (4) countries that are frequent targets of cyber-attacks and have long experience in managing and responding to cyber incidents.

Values and Value Conflicts in the Context of OSINT Technologies for Cybersecurity Incident Response: A Value Sensitive Design Perspective

The negotiation of stakeholder values as a collaborative process throughout technology development has been studied extensively within the fields of Computer Supported Cooperative Work and Human-Computer Interaction. Despite their increasing significance for cybersecurity incident response, there is a gap in research on values of importance to the design of open-source intelligence (OSINT) technologies for this purpose. In this paper, we investigate which values and value conflicts emerge due to the application and development of machine learning (ML) based OSINT technologies to assist cyber security incident response operators. For this purpose, we employ a triangulation of methods, consisting of a systematic survey of the technical literature on the development of OSINT artefacts for cybersecurity (N = 73) and an empirical value sensitive design case study, comprising semi-structured interviews with stakeholders (N = 9) as well as a focus group (N = 7) with developers. Based on our results, we identify implications relevant to the research on and design of OSINT artefacts for cybersecurity incident response.

The Importance of Cybersecurity Incident Response Plans for Law Firms

Anwaltskanzleien sind zu attraktiven Zielen für Cyberkriminelle geworden. Darüber hinaus werden Cyberangriffe immer komplexer und für Anwaltskanzleien wird es immer schwieriger, mit den sich ständig wandelnden Sicherheitstrends Schritt zu halten. Aus diesem Grund möchte der vorliegende Beitrag hervorheben, dass ein gut ausgearbeiteter Incident-Response-Plan im unberechenbaren Kampf gegen Cyberangreifer eine wirksame Waffe im Arsenal einer Anwaltskanzlei sein kann. Der Beitrag soll auch Schritte aufzeigen, die Kanzleien unternehmen können, um effektive Strategien zur Incident Response zu entwickeln. Darüber hinaus werden die Vorteile und grössten Herausforderungen bei der Reaktion auf Sicherheitsvorfälle erörtert. (xf)

Methodology for Predictive Cyber Security Risk Assessment (PCSRA)

With the current impulse of Cyberattacks, data becomes of central importance. There are many challenges in how they are used that also need to be discussed. Defining the suitable cybersecurity incident response model is a critical challenge that all companies face today. With a high number of incidents that happen daily and for which there is not always an adequate response due to the lack of predictive models based on data (evidence), there is a significant investment in research to identify the main factors that can cause such incidents, in and consistently trying to have the most appropriate answer, and ultimately, boosting responsiveness and success. At the same time, there are several different methodologies to assess the risk management of organizations and their level of maturity. The capability assessment is intended to enable organizations to understand better the fundamentals that need to be laid down to deliver cybersecurity successfully. There is, however, a gap in determining an organization's degree of proactive responsiveness to successfully embracing cybersecurity and an even more significant gap in assessing it from a risk management perspective. This work proposes a model to assess this capacity.

Predicting Cybersecurity Risk - A Methodology for Assessments

Defining an appropriate cybersecurity incident response model is a critical challenge that all companies face on a daily basis.However, there is not always an adequate answer. This is due to the lack of predictive models based on data (evidence). There is a significant investment in research to identify the main factors that can cause such incidents, always trying to have the most appropriate response and, consequently, enhancing response capacity and success. At the same time, several different methodologies assess the risk management and maturity level of organizations.There is, however, a gap in determining an organization's degree of proactive responsiveness to successfully adopt cybersecurity and an even more significant gap in assessing it from a risk management perspective. This paper proposes a model to evaluate this capacity, a model that intends to evaluate the methodological aspects of an organization and indicates the apparent gaps that can negatively impact the future of the organization in the management of cybersecurity incidents and presents a model that intends to be proactive.

The Cyber Security Incident Response and Reverse Engineering

Although incident response has always been a crucial component of information security, security administrators frequently ignore it. Whereas, Reverse engineering focuses on the difficult issue of analyzing legacy software code in the absence of appropriate documentation. This paper proposes an approach to understanding cyber security Incident Response and the services it provides followed by Reverse Engineering resources and the practical analysis of a malware named “Alice ATM Malware” in detail.

The Cyber Security Incident Response and Reverse Engineering

Although incident response has always been a crucial component of information security, security administrators frequently ignore it. Whereas, Reverse engineering focuses on the difficult issue of analyzing legacy software code in the absence of appropriate documentation. This paper proposes an approach to understanding cyber security Incident Response and the services it provides followed by Reverse Engineering resources and the practical analysis of a malware named “Alice ATM Malware” in detail.

Optimizing cybersecurity incident response decisions using deep reinforcement learning

<span lang="EN-US">The main purpose of this paper is to explore and investigate the role of deep reinforcement learning (DRL) in optimizing the post-alert incident response process in security incident and event management (SIEM) systems. Although machine learning is used at multiple levels of SIEM systems, the last mile decision process is often ignored. Few papers reported efforts regarding the use of DRL to improve the post-alert decision and incident response processes. All the reported efforts applied only shallow (traditional) machine learning approaches to solve the problem. This paper explores the possibility of solving the problem using DRL approaches. The main attraction of DRL models is their ability to make accurate decisions based on live streams of data without the need for prior training, and they proved to be very successful in other fields of applications. Using standard datasets, a number of experiments have been conducted using different DRL configurations The results showed that DRL models can provide highly accurate decisions without the need for prior training.</span>

Handling Internet Activism During the Russian Invasion of Ukraine: A Campus Network Perspective

The Russian invasion of Ukraine in 2022 raised an enormous wave of Internet activism and distributed denial-of-service (DDoS) attacks launched with the help of common users across the world. In this article, we describe the events of the first days after the invasion from the perspective of the cybersecurity incident response team of Masaryk University in the Czech Republic. We observed hundreds of users intentionally participating in DDoS attacks against Russia from the university’s network. The campus network faced only minor issues in terms of service unavailability, but alerts flooded the cybersecurity team. Two dimensions of the events are highlighted. First, the large-scale attacks in an unexpected direction were highly unusual and brought technical challenges in network monitoring and intrusion detection. Second, hacktivism still violates the campus network’s terms of use and requires the cybersecurity team to communicate the issues very carefully with the community.

Opportunity Cost of Action Bias in Cybersecurity Incident Response

The hours and days immediately following the discovery of a cyber intrusion can be stressful and chaotic for victims. Without a documented and well-rehearsed incident response plan, people are prone to costly fear-based reactions. Action bias is the human tendency to favor action over inaction. It feels better for victims to do something even if rushed decisions are suboptimal to thoughtful, careful alternatives. Furthermore, the null baseline of doing nothing or watchful waiting can sometimes be advantageous. This paper describes an application of opportunity cost to action bias. While these insights are not yet backed by empirical data, this is the first work to examine the intersection of opportunity cost with action bias in cybersecurity incident response. Using Sony Pictures Entertainment as a case study, we discuss the implications of opportunity costs from acting prematurely and, conversely, the opportunity costs of waiting to act.