Information security incident management: Current practice as reported in the literature

Computers and Security

Volumn 45, Issue , 2014, Pages 42-57

  Tøndel, Inger Anne ^a   Line, Maria B ^a,b   Jaatun, Martin Gilje ^a  

^a SINTEF ICT   (Norway)

^b NORWEGIAN UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Norway)

Author keywords

Incident management; Incident response; Information security; ISO IEC 27035; Systematic review

Indexed keywords

ISO STANDARDS; SECURITY OF DATA;

CURRENT PRACTICES; INCIDENT MANAGEMENT; INCIDENT RESPONSE; INFORMATION SECURITY INCIDENTS; ISO/IEC; RECOMMENDED PRACTICE; SYSTEMATIC LITERATURE REVIEW; SYSTEMATIC REVIEW;

INFORMATION MANAGEMENT;

EID: 84902687316     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2014.05.003     Document Type: Article

References (31)

1. A. Ahmad, J. Hadgkiss, and A.B. Ruighaver Incident response teams - challenges in supporting the organisational security function Comput Secur 31 5 2012 643 652
2. R. Anderson, C. Barton, R. Böhme, R. Clayton, M. Eeten, and M. Levi et al. Measuring the cost of cybercrime 11th Workshop on the Economics of Information Security (WEIS'12) 2012
3. R. Barrett, E. Kandogan, P.P. Maglio, E.M. Haber, L.A. Takayama, and M. Prabaker Field studies of computer system administrators: analysis of system management tools and practices Proceedings of the 2004 ACM conference on Computer supported cooperative work (CSCW '04) 2004 ACM New York, NY, USA 388 395 http://doi.acm.org/10.1145/1031607.1031672 (Pubitemid 40928541)
4. E. Brewster, R. Griffiths, A. Lawes, and J. Sansbury IT service management: a guide for ITIL foundation exam candidates 2nd ed. 2012 BCS, The Chartered Institute for IT
5. J.F. Cadavieco, C.R. Pérez, and C.B. Fernández Information technology incident management: a case study of the University of Oviedo and the Faculty of Teacher Training and Education Univ Knowl Soc J (RUSC) 9 2 2012 280 295
6. P. Cichonski, T. Millar, T. Grance, and K. Scarfone NIST SP 800-861: Computer security incident handling guide 2008 National Institute of Standards and Technology
7. J. Cusick, and G. Ma Creating an ITIL inspired incident management approach: roots, response, and results Network Operations and Management Symposium Workshops (NOMS Wksps), 2010 IEEE/IFIP 2010 142 148 10.1109/NOMSW.2010.5486589
8. C.R.B. de Souza, C.S. Pinhanez, and V.F. Cavalcante Information needs of system administrators in information technology service factories Proceedings of the 5th ACM Symposium on Computer Human Interaction for Management of Information Technology (CHIMIT '11) 2011 ACM New York, NY, USA 10 http://doi.acm.org/10.1145/2076444.2076447
9. ENISA Good practice guide for incident management 2010
10. T. Herath, and H.R. Rao Protection motivation and deterrence: a framework for security policy compliance in organisations Eur J Inf Syst 18 2 2009 106 125 10.1057/ejis.2009.6
11. C. Hove, and M. Tårnes Information security incident management: an empirical study of current practice 2013 Norwegian University of Science and Technology
12. S. Ismail, A. Ahmad, and M.A.M. Shukran New method of forensic computing in a small organization Aust J Basic Appl Sci 5 9 2011 2019 2025
13. ISO/IEC 27035:2011 Information technology - Security techniques - Information security incident management 2011
14. M.G. Jaatun, E. Albrechtsen, M. Line, S.O. Johnsen, I. Wærø, and O.H. Longva et al. A study of information security practice in a critical infrastructure application C. Rong, M.G. Jaatun, F.E. Sandnes, L.T. Yang, J. Ma, Autonomic and Trusted Computing Lecture Notes in Computer Science vol. 5060 2008 Springer Berlin Heidelberg 527 539 10.1007/978-3-540-69295-9-42
15. M.G. Jaatun, E. Albrechtsen, M.B. Line, I.A. Tøndel, and O.H. Longva A framework for incident response management in the petroleum industry Int J Crit Infrastruct Prot 2 2009 26 37
16. A. Johnston, and J. Reust Network intrusion investigation preparation and challenges Digit Investig 3 3 2006 118 126 10.1016/j.diin.2006.08.001 http://www.sciencedirect.com/science/article/pii/S1742287606000922 (Pubitemid 44642357)
17. B. Kitchenham, and S. Charters Guidelines for performing Systematic Literature Reviews in Software Engineering 2007 [EBSE Technical Report]
18. E. Koivunen Why wasn't I notified: information security incident reporting demystified 15th Nordic Conference in Secure IT Systems (NordSec 2010) 2010
19. A.G. Kotulic, and J.G. Clark Why there aren't more information security research studies Inf Manag 41 5 2004 597 607 10.1016/j.im.2003.08.001 http://www.sciencedirect.com/science/article/pii/S0378720603000995
20. P. Kral The incident handlers handbook [Technical Report] 2011 SANS Institute
21. S. Kurowski, and S. Frings Computational documentation of IT incidents as support for forensic operations IT Security Incident Management and IT Forensics (IMF), 2011 Sixth International Conference on 2011 37 47 10.1109/IMF.2011.18
22. M.B. Line A case study: preparing for the smart grids - identifying current practice for information security incident management in the power industry Seventh International Conference on IT Security Incident Management and IT Forensics (IMF) 2013
23. S. Metzger, W. Hommel, and H. Reiser Integrated security incident management - concepts and real-world experiences Sixth International Conference on IT Security Incident Management and IT Forensics (IMF) 2011 107 121
24. K. Möller Setting up a GRID-CERT, Experiences of an academic CSIRT Campus Wide Inf Syst 24 4 2007 260 270
25. H.S. Rhee, Y.U. Ryu, and C.T. Kim Unrealistic optimism on information security management Comput Secur 31 2 2012 221 232 10.1016/j.cose.2011.12.001 http://www.sciencedirect.com/science/article/pii/S0167404811001441
26. C. Robson Real world research 3rd ed. 2011 John Wiley & Sons Ltd.
27. F. Scholl, and M. Mangold Proactive incident response Inf Syst Secur Assoc J 9 2 2011 http://www.issa.org/?page=JournalFebruary2011
28. R. Werlinger, K. Hawkey, K. Muldner, P. Jaferian, and K. Beznosov The challenges of using an intrusion detection system: is it worth the effort? Proceedings of the 4th symposium on Usable privacy and security (SOUPS '08) 2008 ACM New York, NY, USA 107 118 http://doi.acm.org/10.1145/1408664.1408679
29. R. Werlinger, K. Muldner, K. Hawkey, and K. Beznosov Preparation, detection, and analysis: the diagnostic work of IT security incident response Inf Manag Comput Secur 18 1 2010 26 42
30. M.J. West-Brown, D. Stikvoort, K.P. Kossakowski, G. Killcrece, R. Ruefle, and M. Zajicek Handbook for Computer Security Incident Response Teams (CSIRTs) 2003
31. M. Wilson, D.E. de Zafra, S.I. Pitcher, J.D. Tressler, and J.B. Ippolito NIST SP 800-816: Information technology security training requirements: a role- and performance-based model 2008 National Institute of Standards and Technology