Cybersecurity Incident Response and Management

This chapter presents a systematic literature review on best practices regarding cybersecurity incident response handling and incident management. The study identifies incident handling models that are used worldwide when responding to any type of cybersecurity incident. The authors highlight the importance of understanding the current cyber threat landscape in any incident response team and their standard operations procedures. The chapter provides guidelines for building a cybersecurity incident team in terms of incident categorization, capabilities, tasks, incident cost calculation, and metrics.

Wearable screen-printed SERS array sensor on fire-retardant fibre gloves for on-site environmental emergency monitoring

Glove-based wearable sensors can offer the potential ability to fast and on-site environmental threat assessment, which is crucial for timely and informed incident management. In this work, an on-demand surface-enhanced...

Logical Structure of Actions to Reduce the Impacts of Traffic Incidents

Traffic incidents (such as broken-down vehicles, accidents, flat tires and other) constitute an important concern in the urban context, impacting the sustainable development. Thus, currently, the proposition of efficient traffic incident management systems has been encouraged to re-establish road safety and restore the network's traffic capacity. Thus, this paper aims to investigate the main impacts of traffic incidents and elaborate a logical structure of actions that should be employed to improve their management. The results show that many impacts can be identified in the three spheres of sustainable development and improvement actions must accelerate responses to emergencies, invest in Intelligent Transportation System (ITS), develop urban planning with a focus on more roads secure and enforce existing laws and regulations.

ANALISIS LAYANAN TI PADA DOMAIN SERVICE OPERATION DENGAN MENGGUNAKAN FRAMEWORK ITIL V3

Operasional bisnis PT. PLN (Persero) ULP sudah memanfaatkan TI dalam meberikan pelayanannya yang berupa sistem informasi berbasis website, layanan yang diberikannya seperti pelayanan online pemasangan listrik baru, penambahan daya listrik dan penyambungan sementara. Namun dalam penerapan operasional layanan TI yang berjalan belum sepenuhnya mengarah pada satu pengelolaan yang mengacu pada pedoman manajemen TI. Untuk memaksimalkan kinerja layanan TI, implementasi dari manajemen insiden dan masalah dengan kerangka kerja Information Technology Infrastructure Library (ITIL) merupakan salah satu solusi yang dibutuhkan untuk meningkatkan kualitas layanan TI di PT. PLN (Persero) ULP Lubuklinggau. Domian pada framerwork ITIL V3 yang digunakan dalam penelitian ini adalah domain service operation. Hasil yang didapatkan menunjukkan bahwa tingkat kematangan dari proses event management, incident management, dan problem management berada pada level 3 atau Defined serta request fulfillment berada pada level 2 atau Repeatable. Dengan nilai 3,06 untuk event management, nilai 3,12 untuk incident management, nilai 2,54 untuk request fulfillment, nilai 3,24 untuk problem management.

Shipping Accidents Dataset: Data-Driven Directions for Assessing Accident’s Impact and Improving Safety Onboard

Recent tragic marine incidents indicate that more efficient safety procedures and emergency management systems are needed. During the 2014–2019 period, 320 accidents cost 496 lives, and 5424 accidents caused 6210 injuries. Ideally, we need historical data from real accident cases of ships to develop data-driven solutions. According to the literature, the most critical factor to the post-incident management phase is human error. However, no structured datasets record the crew’s actions during an incident and the human factors that contributed to its occurrence. To overcome the limitations mentioned above, we decided to utilise the unstructured information from accident reports conducted by governmental organisations to create a new, well-structured dataset of maritime accidents and provide intuitions for its usage. Our dataset contains all the information that the majority of the marine datasets include, such as the place, the date, and the conditions during the post-incident phase, e.g., weather data. Additionally, the proposed dataset contains attributes related to each incident’s environmental/financial impact, as well as a concise description of the post-incident events, highlighting the crew’s actions and the human factors that contributed to the incident. We utilise this dataset to predict the incident’s impact and provide data-driven directions regarding the improvement of the post-incident safety procedures for specific types of ships.

Incident Management for Explainable and Automated Root Cause Analysis in Cloud Data Centers

Effective root cause analysis (RCA) of performance issues in modern cloud environ- ments remains a hard problem. Traditional RCA tracks complex issues by their signatures known as problem incidents. Common approaches to incident discovery rely mainly on expertise of users who define environment-specific set of alerts and >target detection of problems through their occurrence in the monitoring system. Adequately modeling of all possible problem patterns for nowadays extremely sophisticated data center applications is a very complex task. It may result in alert/event storms including large numbers of non-indicative precautions. Thus, the crucial task for the incident-based RCA is reduction of redundant recommendations by prioritizing those events subject to importance/impact criteria or by deriving their meaningful groupings into separable situations. In this paper, we consider automation of incident discovery based on rule induction algorithms that retrieve conditions directly from monitoring datasets without consuming the sys- tem events. Rule-learning algorithms are very flexible and powerful for many regression and classification problems, with high-level explainability. Since annotated or labeled data sets are mostly unavailable in this area of technology, we discuss data self-labelling principles which allow transforming originally unsupervised learning tasks into classification problems with further application of rule induction methods to incident detection.

Effect of after action review on safety culture and second victim experience and its implementation in an Irish hospital: A mixed methods study protocol

Background After Action Review is a form of facilitated team learning and review of events. The methodology originated in the United States Army and forms part of the Incident Management Framework in the Irish Health Services. After Action Review has been hypothesized to improve safety culture and the effect of patient safety events on staff (second victim experience) in health care settings. Yet little direct evidence exists to support this and its implementation has not been studied. Aim To investigate the effect of After Action Review on safety culture and second victim experience and to examine After Action Review implementation in a hospital setting. Methods A mixed methods study will be conducted at an Irish hospital. To assess the effect on safety culture and second victim experience, hospital staff will complete surveys before and twelve months after the introduction of After Action Review to the hospital (Hospital Survey on Safety Culture 2.0 and Second Victim Experience and Support Tool). Approximately one in twelve staff will be trained as After Action Review Facilitators using a simulation based training programme. Six months after the After Action Review training, focus groups will be conducted with a stratified random sample of the trained facilitators. These will explore enablers and barriers to implementation using the Theoretical Domains Framework. At twelve months, information will be collected from the trained facilitators and the hospital to establish the quality and resource implications of implementing After Action Review. Discussion The results of the study will directly inform local hospital decision-making and national and international approaches to incorporating After Action Review in hospitals and other healthcare settings.