Incident Response System Research Articles

From Monitoring to Observability: A Paradigm Shift in IT Operations

This article explores the paradigm shift from traditional monitoring to observability in IT operations, driven by the increasing complexity of modern distributed systems, data overload, evolving cybersecurity threats, and the need for proactive problem-solving. Observability platforms, built on the four pillars of events, metrics, traces, and logs, provide comprehensive insights into system behavior and performance. Adopting observability practices offers numerous benefits, including automated discovery of system components, dependency mapping, topology visualization, correlative intelligence, faster root cause diagnosis, and more accurate anomaly detection through auto-baselining. Organizations that embrace observability report significant improvements in incident response times, system reliability, and overall operational efficiency. The article guides successfully transitioning to an observability-focused approach by embracing automation, fostering a culture of observability, implementing the right tools, and leveraging AI and machine learning for advanced analytics and insights.

Organisational models for managing Public Health Emergencies of International Concern (PHEICs) in the South-East Asia Region (SEAR) nations: protocol for a systematic review

IntroductionThe current literature suggests that the frequency and complexity of public health emergencies are rising and this trend will likely continue. From 2000 to 2023, seven events have been declared...

Understanding the Challenges and Opportunities for Strengthening Incident Response System in India: A Stakeholder Survey

Disaster response is an integral part of disaster management. Recognizing the critical role of effective response in disaster management, India developed the Incident Response System (IRS). The Unified Incident Response System for India is a complete system that aims to improve how the country responds to emergencies and tragedies. IRS operates like a complex orchestra where each stakeholder plays a crucial role in mitigating risk and restoring normalcy. It is meant to bring together all emergency services along with response teams onto a single platform, thereby making it easier to organize for responding to disasters quickly and successfully. The system has a central command and control center, a mobile app for people to share incidents and an online database containing emergency contacts and tools. With this method in place, India will be better able to handle emergencies while making sure its people are safe. It is an effort towards making the country more resilient and ready for emergencies and crises. The present study examines five key elements on incident response, highlighting common challenges like lack of preparedness, inadequate training and sector-specific complexities. It presents opportunities for improvement through investing in training, adopting automation, tailoring plans for different industries and fostering collaboration across organizations and Government.

A Proposed Approach to Integrate Application Security Vulnerability Data with Incidence Response Systems

This paper has proposed a method to develop an attack tree, from application vulnerability data discovered through tests and scans and correlation analysis using incoming transaction requests monitored by a Web Application Firewall (WAF) tool. The attack tree shows multiple pathways for an attack to shape through vulnerability linkages and a deeper analysis of the Common Weakness Enumeration (CWE) and Common Vulnerability Exposure (CVE) mapping to individual vulnerabilities. By further relating to a parent, peer, or child CWE (including CWEs that follow another CWE and in some cases precede other CWEs) will provide more insight into the attack patterns. These patterns will reveal a multi-vulnerability, multi-application attack pattern which will be hard to visualize without data consolidation and correlation analysis. The correlation analysis tied to the test and scan data supports a vulnerability lineage starting from incoming requests to individual vulnerabilities found in the code that traces a possible attack path. This solution, if automated, can provide threat alerts and immediate focus on vulnerabilities that need to be remedied as a priority. SOAR (Security Orchestration, Automation, and Response), XSOAR (Extended Security Orchestration, Automation, and Response), SIEM (Security Information and Event Management), and XDR (Extended Detection and Response) are more constructed to suit networks, infrastructure and devices, and sensors; not meant for application security vulnerability information as collected. So, this paper makes a special case that must be made for integration of application security information as part of threat intelligence, and threat and incident response systems.

Organization of response to information security incidents

Objective. Development of practical recommendations for creating an effective information security incident response system. Method. The article includes an analysis of existing methods and tools for detecting and analyzing information security incidents, as well as a study of the consequences of such incidents and their impact on the work of a company or organization. Result. Development of a set of practical recommendations aimed at creating an effective information security incident response system. During the analysis of existing methods and tools for the detection and analysis of information security incidents, the most effective and adapted approaches were identified. These methods include both technical means of detection and rapid incident response processes. The recommendations were created taking into account the characteristics of companies and organizations of various industries and are also intended for use by persons who do not have deep knowledge in the field of information security. The recommendations include clear step-by-step instructions, resources and tips that will allow companies to easily implement the proposed measures in their practice. Conclusion. The development of an effective information security incident response system is critically important for companies and organizations, as they face an increasing number of cyber-attacks and threats to information security. Creating an effective information security incident response system is an integral part of a successful business strategy. The developed practical recommendations have the potential to significantly reduce the risks and damage associated with information security, even for companies and organizations without prior experience in this field. These recommendations focus not only on technical aspects, but also on organizational measures to ensure timely detection, analysis and response to incidents.

The development of new cyber security and networking solutions using Artificial Intelligence and machine learning

The convergence of Artificial Intelligence (AI) and Machine Learning (ML) has ushered in a revolutionary period in networking as well as cybersecurity. This paper explores the important impact of ML and AI on certain fields. Data shows that their use has increased dramatically, particularly in threat detection and predictive modelling. Security measures have been significantly strengthened by automated incident response systems and behavioural analysis powered by AI. The integration of threat intelligence and artificial intelligence has transformed the battle against cyberattacks, whereas real-time data analysis facilitates proactive maintenance. As long as privacy, and surveillance, alongside prejudice concerns, exist, the moral implementation of AI will remain a major worry. This analysis emphasizes the critical importance of ethical AI development. Future scope will include increased integration and more accurate threat detection, but there will also be issues with data quality, and privacy, including the requirement for strong ethical standards. It is of the utmost importance to strike a balance between these difficulties and the amazing promise of AI and ML in order to shape networking and cybersecurity in the future.

Comparative Assessment of US Cyber Incident Response Systems

In today's world, cyber threats are becoming a serious issue for companies in all professional sectors. For all organisations, regardless of their field of activity, cyber threats in today's world are undoubtedly a significant challenge. Undoubtedly, modern organisations should set themselves the task of effectively countering cyber threats regardless of their professional industry. To effectively counter these threats, organisations must have effective incident response systems in place, including in cyberspace. There are many incident response frameworks in the US, each with its own advantages and disadvantages. This article offers a comparative analysis of the four leading US cyber incident response frameworks: NIST Cybersecurity Framework (CSF), CISA Cyber Incident Response Guide, ISO/IEC 27001 and NIST Special Publication 800-61. The purpose of the study is to provide organisations with an overview of the four leading incident response frameworks in the US so that they can choose the most appropriate framework for their specific needs. The research was conducted using a qualitative approach that included a thorough review of official documents, a review of relevant current literature, and consultation with cybersecurity professionals. This article is a valuable resource for organisations and companies looking for an effective and efficient method of responding to incidents, including cyber incidents. It provides an overview of the four leading frameworks in the US, allowing organisations to compare their advantages and disadvantages and ultimately choose the most appropriate framework for their specific objectives.

Transformation in substation automation: Cyber-Resilient Digital Substations (CyReDS) in power grids

Abstract The digitalization of substations leads to a high degree of automation, which is referred to as Digital Substations with the use of the IEC 61850. An increase in cybersecurity is necessary, and technically enabled by detection and incident response systems – security-by-design is currently often secondary. The next transformation step of substations is introduced and outlined in this paper as a cyber-resilient digital substation. Based on a state-of-the-art description, this paper presents a definition of cyber resilience for digital substations as a basis for the introduced cyber resilience monitor. The monitor acts as a central instance for recording, assessing and responding to security threats and incidents. Furthermore, the requirements for the system structure of the cyber-resilient digital substation are shown and underpinned with current research approaches.

A Quantitative Assessment of the Impact of Automated Incident Response on Cloud Services Availability

Abstract In the rapidly evolving landscape of cloud computing, ensuring high service availability is paramount for organizations reliant on digital infrastructure. This study conducts a quantitative assessment of the impact of Automated Incident Response Systems (AIRS) on the availability of cloud services. Utilizing a dataset derived from multiple cloud service providers over a twelve-month period, we analyze key performance metrics, including incident response times, resolution rates, and service uptime statistics, both pre- and post-AIRS implementation. The results indicate a statistically significant improvement in service availability following the deployment of AIRS, characterized by reduced incident resolution times and enhanced operational uptime. Furthermore, we present a comparative analysis of traditional incident response methodologies versus automated systems, demonstrating the superior efficiency and reliability of AIRS. The findings underscore the necessity for organizations to embrace automation in incident management to bolster service resilience and optimize customer satisfaction. This study concludes with practical recommendations for organizations considering the integration of AIRS into their operational frameworks. In the rapidly evolving landscape of cloud computing, ensuring high service availability has become a critical concern for organizations that depend heavily on digital infrastructures. This study conducts a comprehensive quantitative assessment of the impact of Automated Incident Response Systems (AIRS) on the availability of cloud services. As cloud environments become increasingly complex, the potential for service disruptions due to incidents—such as hardware failures, security breaches, or configuration errors—poses significant risks to businesses. Through a detailed analysis of incident response metrics obtained from a diverse dataset comprising five leading cloud service providers, this research evaluates key performance indicators including incident response times, resolution rates, and service uptime statistics over a twelve-month period. Employing rigorous statistical methods, the study investigates the relationship between the implementation of AIRS and enhancements in service availability, offering insights into the effectiveness of automation in incident management. The results reveal a statistically significant improvement in service availability post-AIRS deployment, characterized by a dramatic reduction in average incident response times—from 30 minutes to just 10 minutes—and an increase in resolution rates from 75% to 95%. Furthermore, the average service uptime improved from 90% to an impressive 99.5%, demonstrating the potential for organizations to achieve greater operational resilience through the integration of automated systems. The findings also include a comparative analysis of traditional versus automated incident response methodologies, highlighting the superior efficiency and reliability of AIRS. This study emphasizes the necessity for organizations to adopt automated solutions in their incident management frameworks to mitigate the risks associated with downtime and enhance customer satisfaction. The conclusions drawn from this research provide practical recommendations for businesses considering AIRS integration, making a compelling case for the strategic implementation of automated incident response mechanisms in the pursuit of optimal service availability.

Efficient Matching Algorithms between Logs and Indicators for Automatic Incident Response System

Efficient Matching Algorithms between Logs and Indicators for Automatic Incident Response System

Enhancing Salesforce Security: Employing Artificial Intelligence and Automation for Strong Protection

In today's digital age, businesses generally depend heavily on cloud-based platforms like Salesforce to manage client information and handle their regular activities. So, as the usage of these platforms grows, it also becomes necessary to implement increasingly sophisticated security measures in order to guard against attack from hackers. Such traditional protocols do not present a complete solution when it comes to contending with the many-sided nature of modern attacks. This paper looks at how AI and automation are integrated with Salesforce environments. Even in these circumstances, businesses can enhance their defenses against data breaches, unauthorized access, and insider threats by means of AI-driven anomaly analysis, automated incident response systems and threat detection capabilities. This paper shows case studies and practical implementations of AI and automation in pointing to exceptional vulnerabilities, automating security operations and adhering to regulatory standards. The paper intends to give direction for future Salesforce security, highlighting the importance of AI and automation in safeguarding privacy and protecting customer trust.

Designing an intelligent emergency response system to minimize the impacts of traffic incidents: a new approximation queuing model

ABSTRACT A road traffic accident is an unexpected, irregular activity on the road network that sources a high excess demand relative to the reduced road capacity, resulting in traffic congestion and delays for travellers. The emergency response agencies need to shortly discover, respond to, and clear road traffic accidents in order to decrease the impacts of incidents on traffic congestion. To create an intelligent incident management response system for road networks, real-time data on traffic volumes and accident rates can be used in a queuing model for the allocation/relocation of available resources in response to incidents. In this study, a new queuing-based formulation is proposed for determining the positioning of emergency response units. The greatest benefit of the proposed dynamic model is a reduction in the time it takes response teams to clear accidents, remove debris on the roadway, and restore the normal traffic network. The analysis of actual accident data from New York City demonstrated that the proposed dynamic allocation strategy can contribute to reducing the total waiting time caused by accidents on roads instead of simply minimizing the average response times. The obtained results from testing the presented model revealed that the average costs in terms of the response time and the average delay reduced by 45% and 38%, in comparison to the static deployment model, respectively. HIGHLIGHTS A queuing model by characterizing the traffic congestion information is proposed. A dynamic policy of allocating response units using a queue system is studied. We study the advantages of our non-myopic model over the alternative myopic case. We show the effectiveness of the model by testing it on New York city incident data. The proposed dispatching strategy reduces the response time and the average delay.

Development of an Early Warning and Incident Response System for the Protection of Visitors from Natural Hazards in Important Outdoor Sites in Greece

Safety in touristic destinations is of utmost importance since tourists’ preferences change frequently in response to emerging threats. Natural hazards are a significant risk and, as such, they need to be considered in the effort for safe tourism. Services and systems monitoring and predicting extreme natural phenomena and disasters in sites of special tourist and cultural interest can lead to more effective risk management and incident response. This paper presents Xenios, a system under development in Greece that provides early warning and risk communication services via web-based and mobile phone applications. We present the user requirements analysis contacted, which led to the design of a modular system architecture through a formal Business Process Model procedure. Currently, early warning systems for wildfire, floods, and extreme weather events are offered, based on a fusion of information from satellite imagery, meteorological forecasts, and risk estimation models. Moreover, visitors’ dispersion monitoring via unmanned aerial vehicles (UAVs) and Wi-Fi connection signals is also offered, along with emergency response planning and ticketing system’s interfacing. The system is built around a modular architecture that permits the easy integration of new subsystems or other danger forecasting modules, depending on the site’s actual needs and limitations. Xenios also provides a mobile app for site visitors, which establishes a communication link for sending alarms, but also serves them with useful tourist information, so that they are encouraged to download and use the app. Finally, the opportunities for supporting a viable business model are also discussed. The results of this study could prove useful in designing other natural risk management systems for sites of cultural and natural interest.

ИССЛЕДОВАНИЕ IRP-СИСТЕМ НА ОСНОВЕ АНАЛИЗА МЕХАНИЗМОВ РЕАГИРОВАНИЯ НА ИНЦИДЕНТЫ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The article discusses the features and functions of information security incident response systems. The analysis of modern IRP solutions is presented and the process of responding to typical incidents in systems of this class is described. Based on expert opinions, a list of criteria was formed, which were divided into groups by areas of functional responsibility for further comparison of the work of IRP systems. The assessment of the main and additional characteristics of IRP-systems was carried out using the formed criterion groups. The analysis of the comparison results showed that the most promising solutions are R-Vision IRP, IBM Resilient IRP and open-source solution - The Hive. The algorithm of the module for preventing phishing attacks was developed and presented, the software implementation of which was made using the Python language. As part of the integration capabilities of The Hive, a custom response function was implemented that not only potentially improved the system's performance in preventing phishing attacks, but also increased employee awareness of this threat. The result is an IRP system with personal flexible customization of individual elements and is the basis for the formation of the Security Center (SOC), which will bring the information security of organizations to a new level.

Himalayan Earthquakes and Developing an Earthquake Resilient Society

Abstract Himalayan region is seismically one of the most active continental regions. It experienced at least 4 M ~ 8 earthquakes during an active phase from 1897 to 1952. However, no such earthquake has occurred since 1952. Detailed investigations have revealed that the region is currently in a seismic quiescence phase, and enough strains have been accumulated to source several M ~ 8 earthquakes. However, when and where such an earthquake would occur cannot be forecasted. Even if such an earthquake is forecasted to occur, can everyone leave to a safe place? That is not practical. It is therefore important to learn to live with earthquakes and develop an earthquake resilient society. Recent earthquakes have demonstrated the effectiveness of such an approach. One very effective way to develop earthquake resilient society is to create an earthquake scenario for the repeat of an earlier earthquake, estimate the losses, and then go through an exercise of imparting and sharing with public, state and central governance the ways and means of reducing the anticipated losses. The National Disaster Management Authority (NDMA), Government of India, in collaboration with other agencies, built earthquake scenarios for the repeat of the 1905 Kangra earthquake of M ~ 8 and 1897 Shillong earthquake of M 8.7. Appropriate ground motion prediction equation was used to generate earthquake intensities. The intensities of the hypothetical Mw 8 earthquake located at Mandi in Himachal Pradesh (close to the epicenter of 1905 Kangra earthquake) were compared with the 1905 Kangra earthquake’s isoseismals and found to be satisfactory. For the 1897 Shillong earthquake, the isoseismals drawn by experts for the 1897 earthquake were used. Using the 2011 Census data for demography and building typology, it was estimated that if the hypothetical Mandi earthquake occurs in the middle of the night, the human lives lost would be ~ 959100 combining the states of Himachal Pradesh, Punjab, Haryana and the Union Territory of Chandigarh. It may be noted that the 1905 earthquake had claimed ~ 20,000 human lives. For the repeat of Shillong M 8.7 earthquake in the mid of the night, the number of lives lost estimated would be ~ 423000 in the 8 north-east states (Assam, Arunachal Pradesh, Meghalaya, Sikkim, Nagaland, Manipur, Tripura and Mizoram). NDMA took up detailed preparatory exercises involving the center and state bodies for Rapid Visual Screening (RVS) of lifeline buildings; school sensitization events; Incident Response System (IRS); and Awareness Generation programs involving local celebrities and a variety of news media. National Disaster Response Force (NDRF) and State Disaster Response Force(s) (SDRF) played a crucial role. To test the preparedness, mega-mock drills were held on 13 February 2013 for the 3 north-western states and UT Chandigarh; and on 10 and 13 March 2014 for the 8 north-eastern states. Performances of all the sectors were evaluated by independent observers. There was an excellent media coverage and the very purpose of generating awareness of the losses due to foreseeable earthquakes and how to reduce them was amply demonstrated. It is important to conduct similar exercises in other regions falling under Seismic Zones V and IV of the country. Of utmost importance is educating school students on an yearly basis, ways and means of developing earthquake resilience.

Retail level Blockchain transformation for product supply chain using truffle development platform

In any business network for record transactions, validation, and track assets, we have used a Blockchain platform, which is shared a distributed ledger that used cryptography techniques. Globally, there are different rules and operating procedures in the supply chain network. These regulations are used for end-to-end tracking between industries of different countries. The major problem faced today is asset traceability, and it is addressed with the usage of Blockchain technology. Greater asset traceability is provided using this technology. Throughout this research study, we suggest a commodity traceability network focused on blockchain technologies, which permanently stores all commodity history in a global database by way of smart contracts and creates a chain that can trace back to the source of goods. In particular, we built an incident response system to check the parties’ identity and ensure the legitimacy of the transaction. And all events are stored permanently in the form of logs to manage disputes and track accountable entities. Also, a device prototype is designed utilizing truffle research nets. Initially, a user login form is developed to make a part of the Blockchain, followed with a function to add an entry of the stock-keeping unit (SKU) into the Blockchain. The SKU is used for adding the product or item into the Blockchain, i.e., the product information is added like “Dairy Milk”, then one transaction is complete. The local languages like Urdu and Hindi are supported the SKU. All users of the retail network can be accessed the SKU “Id” of that product, and it can update the status of the product. So, the history of the product is saved in the block until the customer block in-network, and the customer can access it by using the QR scan code. Customer confidence is increased, and customer satisfaction reflects in sales.

Integrating Spatial Data Analysis for Road Traffic Incident Response System

Integrating Spatial Data Analysis for Road Traffic Incident Response System

Observing Cyber Security Incident Response: Qualitative Themes From Field Research

Cyber security increasingly focuses on the challenges faced by network defenders. Cultural and security-driven sentiments about external observation, as well as publication concerns, limit the ability of researchers to understand the context surrounding incident response. Context awareness is crucial to inform design and engineering. Furthermore, these perspectives can be heavily influenced by the targeted sector or industry of the research. Together, a lack of broad contextual understanding may be biasing approaches to improving operations, and driving faulty assumptions in cyber teams. A qualitative field study was conducted in three computer security incident response teams (CSIRTs) and included perspectives of government, academia, and private sector teams. Themes emerged and provide insights across multiple aspects of incident response, including information sharing, organization, learning, and automation. The need to focus on vertical integration of issues at different levels of the incident response system is also discussed. Future research will build upon these results, using them to inform technology advancement in CSIR settings.

Development of Cyber Incident Response System Program of Industrial Control System

Development of Cyber Incident Response System Program of Industrial Control System

Towards Intelligent Disaster Response Systems

Next Generation Incident Response System (NICS) is a platform developed by MIT Lincoln Lab that is currently being used in Macedonia by the Centre for Crisis Management (CCM). It allows coordination during natural disasters between first responders of various departments and allows them to use state of the art tools to communicate and share information. This research focuses on advancing the platform by introducing intelligent agents to the platform, based on machine learning techniques and natural language processing. Our goal is to leverage data generated in social media and feed NICS with automatically processed information from these media categorized in twelve different needs (categories). This paper presents the current state of our research, preliminary results and final goals.