On Automation and Orchestration of an Initial Computer Security Incident Response Using Centralized Incident Tracking System

摘要

A critical computer security incident may cause great damage on an organization such as confidential databreach or malware pandemic. In order to avoid or mitigate such damage, a quick and accurate response against acomputer security incident has been then getting more important. In order to realize these quickness and accuracy,this paper presents the Incident Tracking System (ITS) that orchestrates several information systems and automate aninitial incident response. The ITS automatically locates and isolates a suspicious host, and sends a mail notificationto a person in charge of handling an incident. The ITS can also identify or suggest a user of the suspicious host bynetwork authentication logs or other service logs.