How can organizations develop situation awareness for incident response: A case study of management practice. Issue 101 (February 2021)

• Record Type: Journal Article
• Authors: Ahmad, Atif; Maynard, Sean B.; Desouza, Kevin C.; Kotsias, James; Whitty, Monica T.; Baskerville, Richard L.
• Is Part Of: Computers & security. Issue 101(2021)
• Publication Date: 2021-02
• Subjects: Cybersecurity management -- Information security management -- Incident response -- Cybersecurity -- Situation awareness -- Case study -- Process model; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2020.102122
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Organized, sophisticated and persistent cyber-threat-actors pose a significant challenge to large, high-value organizations. They are capable of disrupting and destroying cyber infrastructures, denying organizations access to IT services, and stealing sensitive information including intellectual property, trade secrets and customer data. Past research points to Situation Awareness as critical to effective response. However, most research has focused on the technological perspective with comparatively less focus on the practice perspective. We therefore present an in-depth case study of a leading financial organization with a well-resourced and mature incident response capability that has evolved as a result of experiences with past attacks. Our contribution is a process model that explains how organizations can practice situation awareness of the cyber-threat landscape and the broad business context in incident response.