The Incident Management (IM) process is one of the core activities for increasing the overall security level of organizations and better responding to cyber attacks. Different security frameworks (such as ITIL and ISO 27035) provide guidelines for designing and properly implementing an effective IM process. Currently, assessing the compliance of the actual process implemented by an organization with such frameworks is a complex task. The assessment is mainly manually performed and requires much effort in the analysis and evaluation. In this paper, we first propose a taxonomy of compliance deviations to classify and prioritize the impacts of non-compliant causes. We combine trace alignment techniques with a new proposed cost model for the analysis of process deviations rather than process traces to prioritize interventions. We put these contributions into use in a system that automatically assesses the IM process compliance with a reference process model (e.g., the one described in the chosen security framework). It supports the auditor with increased awareness of process issues to make more focused decisions and improve the process’s effectiveness. We propose a benchmark validation for the model, and we show the system’s capability through a usage scenario based on a publicly available dataset of a real IM log. The source code of all components, including the code used for benchmarking, is publicly available as open source on GitHub.

A compliance assessment system for Incident Management process / Palma, Alessandro; Acitelli, Giacomo; Marrella, Andrea; Bonomi, Silvia; Angelini, Marco. - In: COMPUTERS & SECURITY. - ISSN 0167-4048. - 146:(2024). [10.1016/j.cose.2024.104070]

A compliance assessment system for Incident Management process

Alessandro Palma
Primo
;
Giacomo Acitelli;Andrea Marrella;Silvia Bonomi;Marco Angelini
2024

Abstract

The Incident Management (IM) process is one of the core activities for increasing the overall security level of organizations and better responding to cyber attacks. Different security frameworks (such as ITIL and ISO 27035) provide guidelines for designing and properly implementing an effective IM process. Currently, assessing the compliance of the actual process implemented by an organization with such frameworks is a complex task. The assessment is mainly manually performed and requires much effort in the analysis and evaluation. In this paper, we first propose a taxonomy of compliance deviations to classify and prioritize the impacts of non-compliant causes. We combine trace alignment techniques with a new proposed cost model for the analysis of process deviations rather than process traces to prioritize interventions. We put these contributions into use in a system that automatically assesses the IM process compliance with a reference process model (e.g., the one described in the chosen security framework). It supports the auditor with increased awareness of process issues to make more focused decisions and improve the process’s effectiveness. We propose a benchmark validation for the model, and we show the system’s capability through a usage scenario based on a publicly available dataset of a real IM log. The source code of all components, including the code used for benchmarking, is publicly available as open source on GitHub.
2024
Incident management; Security governance; Process compliance assessment; Cost model; Trace alignment
01 Pubblicazione su rivista::01a Articolo in rivista
A compliance assessment system for Incident Management process / Palma, Alessandro; Acitelli, Giacomo; Marrella, Andrea; Bonomi, Silvia; Angelini, Marco. - In: COMPUTERS & SECURITY. - ISSN 0167-4048. - 146:(2024). [10.1016/j.cose.2024.104070]
File allegati a questo prodotto
File Dimensione Formato  
Palma_Compliance_2024.pdf

accesso aperto

Note: https://doi.org/10.1016/j.cose.2024.104070
Tipologia: Versione editoriale (versione pubblicata con il layout dell'editore)
Licenza: Creative commons
Dimensione 2.49 MB
Formato Adobe PDF
2.49 MB Adobe PDF

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11573/1717672
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 0
  • ???jsp.display-item.citation.isi??? 0
social impact