Socio-Technical SIEM (ST-SIEM): Towards Bridging the Gap in Security Incident Response

Security Incident Response

Security incident response is concerned with the preparedness, identification, containment, and recovery from security incidents. Developing an information systems security incident response capability is hardly optional for organizations. Without an effective incident response capability, organizations are simply risking their entire business. According to NTT Security’s (2016) Risk Value Report, one security breach can cost an organization a financial loss up to USD $10 million and priceless reputational damage which might be impossible to recover from.

Today, to provide security incident response functionality, organizations typically rely on either internal or external security incident response organizations called Computer Security Incident Response Teams (CSIRTs). These organizations function under different categories, depending on their scope of work and the constituents they support (West-Brown et al., 2003). To mount an effective security incident response, CSIRTs need to provide timely and reliable information about existing security threats and incidents. Timely incident response is a requirement critical to enabling organizations to quickly respond to potential threats. Reliable information is required to ensure organizations’ staff stay focused on the existing threat risk and avoid confusion and distraction.