On Automation and Orchestration of an Initial Computer Security Incident Response

摘要

Computer security has been getting more attentions because a critical computer security incident may cause great damage on an organization such as confidential data breach or malware pandemic. A quick and accurate response against a security incident have been then getting more important. A quick response can reduce not only risk of data breach but also investigating operations. In addition, quickness may enable to contain an incident and prevent malware pandemic. On the other hand, accuracy can avoid unnecessary, excessive and/or wrong operations such as data forensic, re-installing an OS, and isolating an unsuspicious host. In order to realize these quickness and accuracy, this paper discuss to automate and orchestrate an initial incident response against a security incident.