A Comprehensive Semi-Automated
Incident Handling Workflow
Sayed Hadi Hashemi∗, Mohammad Babaeizadeh∗,
Mohsen Nowruzi∗, Hossein Hadian Jazi∗,
Mohammad Shahmoradi∗, Elaheh Biglar Beigi Samani∗
∗APA Research Center
Isfahan University of Technology
{hashemi, babaeizadeh, nowruzi, hadian, shahmoradi, biglarbeigi}@nsec.ir
Abstract—Dramatic growth of Information Technology in ev-
ery organization increased the number of computer security
incidents in recent years. These incidents result in huge finan-
cial and reputational lost even in small companies. Naturally,
demands for computer-related incident management have been
increased. Nowadays, Incident Handling still is a very complex
and critical task which mainly done by human expert teams. The
cost of keeping such team ready 24x7 is very high, especially in
big organizations with large networks. Consequently, automated
Incident Handling is greatly desired. However, this task contains
many factors and is very human dependent that made it
very challenging to automate. In this study, after a review of
Incident Handling methods, a comprehensive workflow for semi-
automated Incident Handling has been proposed. This workflow
has been suggested based on common principles in this concept
and gathers automated processing units with expert teams in a
way which minimizes human efforts for Incident Handling.
Keywords: Incident Handling, Semi-Automated Incident Han-
dling, Incident Management, Computer Security.
I. IN TRO DUC TIO N
By the appearance of “Moris Worm” in 1988, organizations
faced a new problem: prevention of computer security inci-
dents and responding to them [1]. Trying to overcome this
problem, a set of disciplines is defined in every organization
under the title of “Incident Management”. The most impor-
tant discipline of Incident Management is Incident Handling,
which is responding to an incident report as fast as possible
[2].
The security monitoring of the growing networks today is
mostly performed using Intrusion Detection Systems (IDS) [3].
Looking for evidence of malicious behavior, these systems
generate streams of alerts. Trying to detect and analyze an
incident, a security team has two major problems: IDSs
generate lots of false alarms as well as a large number of alerts
for a single event [4]. Correlation Techniques try to overcome
these problems by reducing and fusing these alerts to generate
a more accurate and meaningful attack reports [5].
These technologies provide very basic tools or no means
of responding to security events and only detect them. The
Incident Handling phase is currently depends on Computer
Emergency Response Team (CERT) which faces too many
incident reports everyday to handle and they are not able to
respond to all of them. Attempting to overcome this shortage,
Incident Handling routines have been recommended to avoid
non-important reports and enhance the performance of security
teams.
The famous Incident Handling recommendations pro-
posed by ENISA1[2][6], NIST2[7], CERT/CC[8][9], SANS
Institute[10], and ITU-T3[11][12]. All of these recommenda-
tions are specialized for humans rather than machines and
highly depends on expertise of CERTs. Hence, the cost
of Incident Handling specially in large organizations grows
dramatically due to keep a expert human team ready 24×7
[6]. Crafting a more automated Incident Handling system can
obviously reduce this cost.
The fact is that Incident Handling is a very complex task
and depends on many factors such as type of the incident,
status of the organization, business continuity, capability of
expert teams, and many other factors which make automating
the process very challenging. Furthermore, according to [7]:
“. . . every incident response team relies on the exper-
tise, judgment, and abilities of other teams, including
management, information security, IT support, legal,
public affairs, and facilities management. . . . ”
This paper proposes a comprehensive semi-automated Incident
Handling workflow, since crafting a fully automated Incident
Handling workflow seems impractical. The suggested work-
flow tries to minimize the human effort required for Incident
Handling while covers all aspects of the procedure.
The rest of the paper is organized as follows: Section 2
provides a description of Incident Handling procedure and
related works. Section 3 presents the proposed workflow
and describes its details. Finally, Section 4 draws conclusion
remarks and future works.
II. I NCIDENT HANDLING
Incident Handling is the rapid detection of incidents, while
minimize the effects, mitigate the causes, and restoring the
affected resources [7]. CERTs as the responsible groups for
Incident Handling in organizations, utilize a combinations of
procedures and tools to achieve these goals.
1European Network and Information Security Agency
2National Institute of Standard and Technology
3International Telecommunication Union Telecommunication Standardiza-
tion Sector
1065
6'th International Symposium on Telecommunications (IST'2012)
978-1-4673-2073-3/12/$31.00 ©2012 IEEE
Authorized licensed use limited to: University of Sunderland. Downloaded on March 07,2021 at 07:57:57 UTC from IEEE Xplore. Restrictions apply.
