A comparative analysis of incident reporting formats. Issue 73 (March 2018)

• Record Type: Journal Article
• Authors: Menges, Florian; Pernul, Günther
• Is Part Of: Computers & security. Issue 73(2018)
• Page Start: 87
• Page End: 101
• Publication Date: 2018-03
• Subjects: Incident reporting -- Incident management -- Incident response -- Reporting formats -- STIX -- IODEF -- IODEF-SCI -- VERIS -- X-ARF; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.10.009
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Over the past few years, the number of attacks against IT systems and the resulting incidents has steadily increased. To protect against these attacks, joint approaches, which include the sharing of incident information, are increasingly gaining in importance. Several incident reporting formats build the basis for information sharing. However, it is often not clear how to design the underlying processes and which formats would fit the specific use cases. To close this gap, we have introduced an incident reporting process model and the generic model UPSIDE for basic incident reporting requirements. Subsequently, we have identified state-of-the-art incident reporting formats and used the introduced models to conduct a comparative analysis of these formats. This analysis shows the strengths and weaknesses of the evaluated formats and identifies the use cases for which they are suitable.