Information Security Incident Handling Regulation

Abstract

The article shows the problem of cyber fatigue of the specialists investigating information security incidents. The cause of the problem is the increase in the number of warnings and events generated and logged daily by a protection system. This volume of information is processed using automation tools; nevertheless, it cannot do without human participation. The essence of the issue lies in the fact that specialists do not have a common algorithm for conducting investigations and a roadmap for building a timeline of events. Therefore, it is necessary to change and supplement the existing approach to the work with incidents by unifying the process of identifying the stages of development of a computer incident during an investigation. To do this, the paper studies the issue of algorithmization and describes typical approaches to handling information security incidents. We propose an algorithm that allows processing an information security incident: to obtain information about the access point to the system, the development of an incident in the system, and the general profile of the attacker. In addition, it is assumed that the algorithm can be used for educational purposes to train specialists who work with incidents in order to form and develop basic practical skills by applying this in a case-oriented approach.