Document Type
Article
Publication Date
8-26-2017
Publication Title
Digital Investigation
Volume
22
First Page
62
Last Page
73
Abstract
Security incidents detected by organizations are escalating in both scale and complexity. As a result, security incident response has become a critical mechanism for organizations in an effort to minimize the damage from security incidents. The final phase within many security incident response approaches is the feedback/follow-up phase. It is within this phase that an organization is expected to use information collected during an investigation in order to learn from an incident, improve its security incident response process and positively impact the wider security environment. However, recent research and security incident reports argue that organizations find it difficult to learn from incidents.
A contributing factor to this learning deficiency is that industry focused security incident response approaches, typically, provide very little practical in- formation about tools or techniques that can be used to extract lessons learned from an investigation. As a result, organizations focus on improving technical security controls and not examining or reassessing the effectiveness or efficiency of internal policies and procedures. An additional hindrance, to encouraging improvement assessments, is the absence of tools and/or techniques that organizations can implement to evaluate the impact of implemented enhancements in the wider organization. Hence, this research investigates the integration of lightweight agile retrospectives and meta-retrospectives, in a security incident response process, to enhance feedback and/or follow-up efforts. The research contribution of this paper is twofold. First, it presents an approach based on lightweight retrospectives as a means of enhancing security incident response follow-up efforts. Second, it presents an empirical evaluation of this lightweight approach in a Fortune 500 Financial organization’s security incident response team.
Recommended Citation
Grispos, George; Glisson, William Bradley; and Storer, Tim, "Enhancing Security Incident Response Follow-up Efforts with Lightweight Agile Retrospectives" (2017). Interdisciplinary Informatics Faculty Publications. 46.
https://digitalcommons.unomaha.edu/interdiscipinformaticsfacpub/46
Comments
© 2017 Elsevier Ltd. All rights reserved.
The final, published version of the article can be found here: https://doi.org/10.1016/j.diin.2017.07.006