Information Security Incident Management Research Articles

Evaluating the status of information security management in faculty libraries: a case study of Allameh Tabatabai University

ABSTRACT Aim This study aims to evaluate the status of Information Security Management in Faculty Libraries at Allameh Tabatabai University, Tehran, Iran. This study is based on the standard of ISO/IEC 27,002. Method The research method is a descriptive survey. Data was collected through a researcher-made questionnaire based on the ISO/IEC standard 27,002 which includes 11 main indicators and 39 sub-components. The statistical population of this study is 45 main and middle managers of faculties’ libraries of Allameh Tabatabai University located in Tehran (Faculties of Law, Psychology and Educational Sciences, Management and Accounting, Physical Education, Literature and Foreign Languages, Communication Sciences, Economics, Social Sciences, Mathematical and Computer Sciences). Due to the limited statistical population, sampling was not performed. Data analysis was done using descriptive statistics, inferential, and SPSS software. Findings The average score of information security management performance in the faculty libraries of Allameh Tabatabaei University located in Tehran according to ISO/IEC27002 is above average. Examination of the average scores of performance evaluation indicators of faculty libraries of Allameh Tabatabai University showed that four indicators including Information Security Management Policy, Information Security Incident Management, Cryptography, and Security Supplier Relationships are not in a favorable situation and need attention from the relevant managers. In other indicators, the performance of faculty libraries is at the desired level. Conclusion The results show a desirable level of information security management in the faculty libraries of Allameh Tabatabai in Tehran. However, some indicators, such as Information Security Policies, Information Security Incident Management, Cryptography, and Supplier Relationships, are still weaker. Therefore, to achieve security goals some suggestions are provided.

A COMPARATIVE ANALYSIS OF INFORMATION SECURITY INCIDENTS IN PUBLIC ADMINISTRATION IN SELECTED EUROPEAN UNION COUNTRIES

The article presents the issue of information security incident management in public administration. The goal of security incident management is to minimize the negative impact of incidents and ensure the continuity of the organization's operations. It is critical to know what the threats are, including the number and types of incidents reported. The article outlines key incident management and legal issues related to the topic of security incidents and the work of computer incident response teams. Examples of incidents that took place recently in public administration units in Poland were also presented. This was followed by an analysis of statistical data on reported incidents in Poland in the years 2020-2022, and the results were compared with the number of incidents reported in selected European Union countries. The results of the study show that the dominant type of incidents is fraud (mainly phishing), and public administration is one of the main targets of cybercriminals' attacks. Difficulties in conducting such comparative analysis have also been demonstrated.

Information security incident management using iso 27035 standard

The data and information management process at BMKG entails certain risks related to information security incidents. There needs to be more emphasis on addressing these incidents regarding policies, procedures, technology, and human resources. This research project aims to develop an incident management system by ISO 27035 standards. Qualitative research methods have been employed for BMKG Communication Network Center case studies. The approach involves aligning information security incident management with BMKG's business processes. The outcome of this research includes creating policies, documents, and standardized procedures designed to enhance BMKG's capabilities in effectively managing and mitigating incident threats.

Lexical method for solving a multicriteria problem of selecting a SIEM for building a situational center for cybersecurity

The author considers the creation of a Cybersecurity Situation Center (CSC), its tasks and composition, and also provides the main technological tools that should be included in an effective CSC. Particular attention is paid to the information security incident management system (SIEM), which is key to the CSC, and its purpose and main tasks that it should solve are considered. The authors analyzes the peculiarities of solving the problem of rational selection of a SIEM. The groups of indicators characterizing the degree of fulfillment of the requirements for a SIEM are allocated and their examples are given. The use of fuzzy set theory for processing expert information on qualitative indicators characterizing a SIEM is proposed. The features related to making a rational decision on the choice of a SIEM are analyzed. Groups of indicators that can help in assessing the degree of compliance of a SIEM with the requirements are allocated, and examples of these indicators are given. In order to process expert information on the qualitative indicators of a SIEM, the use of fuzzy set theory is proposed. A formal statement of the problem of selecting a SIEM is presented and the main stages of its solution are proposed, including the preparation of initial data, the choice of a method for solving the multi-criteria problem of rational selection of a SIEM and the development of an algorithm. It is proposed to use the method of normalization of quantitative indicators of a SIEM and the method of pairwise comparisons based on rank estimates to process its qualitative indicators. The use of the Saaty scale with 9 point values to obtain membership functions for the qualitative characteristics of a SIEM based on expert evaluation is considered. An algorithm for constructing membership functions of SIEM characteristics for each fuzzy term is developed. Methods for solving multi-criteria problems are described and the use of the lexical method is proposed to solve the problem of rational selection of a SIEM in the course of building a Cybersecurity Situation Center. An algorithm for its implementation has been created and implemented, and to demonstrate its effectiveness, an example of its use for the rational selection of a SIEM is given. In addition, recommendations for the practical use of the obtained results are given.

Применение средств экспертизы Blue Team в процессе мониторинга информационных систем на примере платформы TI (Threat Intelligence)

The purpose of this scientific study is to analyze the possibilities of increasing the effectiveness of protection against cyber threats through the use of Blue Team expert systems. The paper provides an overview of various Blue Team expert systems, including advanced detection and response (XDR) systems, information security incident response platforms (IRPs), incident management, automation and response (SOAR) systems, as well as cyber intelligence systems for threat analysis (TI). Threat Intelligence processes are analyzed, including the collection, analysis and interpretation of information about cyber threats. Particular attention is paid to the cyber intelligence platform for threat analysis – TI MISP, including the analysis of the data model of this platform. An example of working with the CVE-2022-26134 vulnerability is provided, demonstrating the effectiveness of using the TI MISP platform to identify threats and take measures to prevent them. At the end of the work, conclusions were drawn about the advantages and disadvantages of using a cyber intelligence platform for threat analysis. In this regard, the use of Blue Team expert systems, including the TI platform, in the process of monitoring information systems can significantly increase the efficiency of identifying computer incidents and provide more reliable protection of information infrastructure, despite their shortcomings.

Methods of Identifying Vulnerabilities in the Information Security Incident Management Process

"The application of tools and methods to improve the effectiveness of the information security management system by detecting and neutralizing cyber attacks, monitoring and blocking DDoS attacks, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), blocking TOR Exit Nodes, blocking Layer 7 Regular Expression attacks, web filtering, blocking malware attacks, ransomware, spammers and spam servers has become a sine-qua-non requirement in the management of information security incidents in order to minimize their impact on IT systems. The paper provides insight into the impact of integrating much-needed security requirements for information technology users in military systems. The collection of information was carried out on a statistical sample of 128 students from military academies in Romania, Bulgaria, Poland. The research methods are complemented by cross-sectional (questionnaire, survey, observation) and observational methods."

Information Security Management Maturity Models

Several maturity models for organizations, their subsystems and processes, for example, information security (IS) incident management are known. Continuing our earlier analysis of the most common maturity models (MMs), models and approaches to assessing the maturity level (ML) of organization's IS management (ISM) maturity, namely The Bank of Russia's ISM MM, ISMS Maturity Capability Model, NIST's IS MM, Open Group's ISM MM, Gartner's Security and Risk Management ML assessment, IS Risk Management Process MM, Security Incident Management Models, and IS Monitoring MM, are selected for consideration within the framework of this research.

Analysis correlation of the Implementation Framework COBIT 5, ITIL V3 and ISO 27001 for ISO 10002 Customer satisfaction

This study aims to determine and provide information about the corellation of COBIT 5, ITILV3 ,and ISO 27001 for customer satisfaction. This study uses a causal associative method with a quantitative approach. The population of this research is all customers of company Quota Broadband Internet. The sampling technique in this research is probability sampling technique through simple random sampling. The research sample was 135 customers. The results showed that there was an corellation of COBIT 5 (6.Customer-oriented service culture ), ITIL V3 (Service Operation 4.2 Incident management), and ISO 27001 (A.16 Information security incident management) for 10002 (3.4 customer satisfaction). The biggest influence is COBIT 5 on ISO 27001 with a T statistic of 6,960 and a P value of 0,000.

IDENTIFICATION OF KEY PERSONS IN THE INFORMATION SECURITY INCIDEN Y INCIDENT MANAGEMENT PROCESS AND T PROCESS AND DISTRIBUTION OF ROLES BETWEEN THEM

This research paper is devoted to the process of information security incident management and the distribution of the roles of key persons in this process. The skills required for members of the information security incident response team are considered, positions and responsibilities are given - typical positions that exist in each organization, testing and improvement procedures are given, the role of the information security incident response team members and employee positions is shown. The quality of the group leader is reflected; responsible for personnel management, scoping and reporting on the state of the organization at a higher level of the hierarchy.

AUDIT KEAMANAN SISTEM INFORMASI DI DINAS XYZ PROVINSI LAMPUNG MENGGUNAKAN STANDAR ISO/IEC 27001:2013

Audit of Information security system in the Communication and Information department is needed to determine the extent of information system carried out. This reasearch uses the ISO/ IEC 27001: 2013. Data from this reasearch were obtained based on the result of interview, observation and questionnaire. The respondent conducted a self assessment, then the researcher observe. The results of this study indicate that the average maturity level of the respondent is at level 2 (repeatable) with a value of 2.13 and the average maturity level of the finding is level 2 (repeatable) with a value of 2.40. The difference between the respondent value and the finding value show that in the sub domain information security incident management. This difference occur due to the absence of existing SOP procedure and criteria. Overall, there is no policy in developing the system through a process of security testing.

IoTBlockSIEM for information security incident management in the internet of things ecosystem

The Internet unfolded enormous opportunities to the modern computing world where not only humans but also computers and machines, as well as any tiny sensing devices, can communicate and collaborate. The Internet of Things (IoT) is still a new concept in its early stages after 20 years of successful usage in various application domains. Nowadays, the "Internet of Things Ecosystem" term is being used more often that emphasizes its complex internal structure and functionality. Based on the available standards on the IoT’s generalized architecture and reference model, the IoT ecosystem is presented as a security object to be protected. Numerous security controls, collecting raw data for complex and multi-stage processing and further detection of events related to information security (IS), are located on its layers. The IS incident management process with different routine actions for the IoT ecosystems needs automation, for which Security Information and Event Management (SIEM) systems are the best applicable solutions. But modern challenges require modifying two previously known generations of these systems, especially for the IoT ecosystems. A new blockchain-based system called the IoTBlockSIEM is proposed to solve this problem. An example of constructing transactions in the IoTBlockSIEM for the case of its use in managing IS incidents in the IoT ecosystem is provided. Further research concludes the article.

Best Practices for Establishment of a National Information Security Incident Management Capability (ISIMC)

Best Practices for Establishment of a National Information Security Incident Management Capability (ISIMC)

МАТЕМАТИЧЕСКАЯ МОДЕЛЬ КАК СРЕДСТВО ОПТИМИЗАЦИИ СИСТЕМЫ АВТОМАТИЗАЦИИ ПРОЦЕССА УПРАВЛЕНИЯ ИНЦИДЕНТАМИ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

Modern information technologies have an increasing importance for development dynamics and management structure of an enterprise. The management efficiency of implementation of modern information technologies directly related to the quality of information security incident management. However, issues of assessment of the impact of information security incidents management on quality and efficiency of the enterprise management system are not sufficiently highlighted neither in Russian nor in foreign literature. The main direction to approach these problems is the optimization of the process automation system of the information security incident management. Today a special attention is paid to IT-technologies while dealing with information security incidents at mission-critical facilities in Russian Federation such as the Federal Tax Service of Russia (FTS). It is proposed to use the mathematical apparatus of queueing theory in order to build a mathematical model of the system optimization. The developed model allows to estimate quality of the management taking into account the rules and restrictions imposed on the system by the effects of information security incidents. Here an example is given in order to demonstrate the system in work. The obtained statistical data are shown. An implementation of the system discussed here will improve the quality of the Russian FTS services and make responses to information security incidents faster.

Network Security Intelligence Center as a combination of SIC and NOC

In modern networks, information security (IS) incidents have become not only numerous and diverse, but more damaging and disruptive. According to 2017 Cyber Attacks Statistics from hackmaggedon.com, among top attacks are malware, account and DNS hijacking, targeted attacks, DDoS, defacements, malvertising, and SQL injection. Various preventive controls based on IS risk assessment results decrease the majority, but not all IS incidents. Any delay and only reactive actions to IS incidents puts organization’s assets under risk. Therefore, an IS incident management system has become an integral part of the whole organization’s governance system. Thus, in this paper, we propose to unite together all advantages of a Security Intelligence Center and a Network Operations Center in a unified Network Security Intelligence Center (NSIC).

The future of information security incident management training: A case study of electrical power companies

Recent attacks and threat reports indicate that industrial control organizations are attractive targets for attacks. Emerging threats create the need for a well-established capacity for responding to unwanted incidents. Such a capacity is influenced by organizational, human, and technological factors. We have conducted extensive fieldwork for 2.5 years in Norwegian electric power companies with the aim of identifying challenges for improving information security incident management practices. Semi-structured interviews, document analysis, a survey and participant observations have been performed as part of this case study.We describe how training for responding to information security incidents is given low priority and that different types of personnel, such as business managers and technical personnel, have different perspectives and priorities in regard to information security. Moreover, there is a gap in how IT staff and control system staff understand information security. Furthermore, cross-functional teams need to be created to ensure a holistic view during the incident response process.To improve the capacity for responding to incidents, organizations need regular training sessions and systematic evaluations after such sessions. There is also the potential for improvement in evaluating minor incidents. A transition from an ad hoc approach to a systematic approach in training and learning requires a reorientation not only by the electric power companies but also by management. We found that learning to learn will enable the organizations to improve their incident response practices.

Examining the suitability of industrial safety management approaches for information security incident management

Purpose – This paper aims to discuss whether recent theoretical and practical approaches within industrial safety management might be applicable to, and solve challenges experienced in, the field of information security, specifically related to incident management. Design/methodology/approach – A literature review was carried out. Findings – Principles, research and experiences on the issues of plans, training and learning in the context of industrial safety management would be suitable for adoption into the field of information security incident management and aid in addressing current challenges. Research limitations/implications – There are a number of reasons why approaches from industrial safety management have something to offer to information security incident management: the former field is more mature and has longer traditions, there is more organizational research on industrial safety issues than on information security issues so far, individual awareness is higher for industrial safety risks and worker participation in systematic industrial safety work is ensured by law. More organizational research on information security issues and continuous strengthening of individual security awareness would push information security to further maturity levels where current challenges are solved. Practical implications – This paper shows that the field of information security incident management would gain from closer collaborations with industrial safety management, both in research and in practical loss prevention in organizations. The ideas discussed in this paper form a basis for further research on practical implementations and case studies. Originality/value – The main audience of this paper includes information security researchers and practitioners, as they will find inspirational theories and experiences to bring into their daily work and future projects.

Current practices and challenges in industrial control organizations regarding information security incident management – Does size matter? Information security incident management in large and small industrial control organizations

This paper reports on the results of an interview study that surveyed current practices regarding information security incident management in small and large distribution system operators (DSOs) in the Norwegian electric power industry. The findings indicate that current risk perception and preparedness are low, especially among small electricity distribution system operators. Further, small distribution system operators rely heavily on their suppliers should incidents occur. At the same time, small distribution system operators are confident that they can handle the worst-case scenarios. This paper documents current perceptions and discusses the extent to which they are likely to hold given the transition towards smart electric grids. Several recommendations are provided based on the findings and the accompanying discussion. In particular, small distribution system operators should strengthen the collaboration with their information technology (IT) suppliers and other small distribution system operators. Furthermore, distribution system operators in general should establish written documentation of procedures, perform preparedness exercises and improve detection capabilities in control systems.

A Framework for Enterprise Security Architecture and Its Application in Information Security Incident Management

An enterprise architecture (EA) plan is a long-term view or blueprint for an organization. It is a very important blueprint for balancing business and Information Technology (IT) and for adding value to an organization. Security is also nowadays an essential dimension for enterprises. It can prevent confidential information from being leaked, and/or stolen, lost succumbing to other serious disasters. There are many studies focusing on EA or on specific aspects of security. However, there are very few studies focusing on enterprise security architecture. This paper focuses on integrating the security dimension into the Zachman EA framework (Zachman, 2007) and is intended to serve as an enterprise security framework (ESA) to assist an organization in successfully and effectively implementing security. The efficacy of the ESA implementation is illustrated through an application in an organization.

Information security incident management: Current practice as reported in the literature

This paper reports results of a systematic literature review on current practice and experiences with incident management, covering a wide variety of organisations. Identified practices are summarised according to the incident management phases of ISO/IEC 27035. The study shows that current practice and experience seem to be in line with the standard. We identify some inspirational examples that will be useful for organisations looking to improve their practices, and highlight which recommended practices generally are challenging to follow. We provide suggestions for addressing the challenges, and present identified research needs within information security incident management.

Modern virtual decoy systems based on honeypot technology

In the article the analysis of existed virtual decoy systems based on honeypot technology was carried out. The analysis showed the evolution of honeypot systems from Low-Interaction Honeypots to modern Gen III Honeynets and pointed to the disadvantages of existed solutions. In addition the classification of honeypot systems by the feature principle was fulfilled. Later these results can be used to develop honeypot systems for efficiency increasing of information security incident management systems.