View in EDS

Human decision-making in computer security incident response

Saved in:
Bibliographic Details
Title: Human decision-making in computer security incident response
Authors: Spring, Jonathan Michael
Committee Members: Pym, D.; Illari, P.
Summary: Background: Cybersecurity has risen to international importance. Almost every organization will fall victim to a successful cyberattack. Yet, guidance for computer security incident response analysts is inadequate. Research Questions: What heuristics should an incident analyst use to construct general knowledge and analyse attacks? Can we construct formal tools to enable automated decision support for the analyst with such heuristics and knowledge? Method: We take an interdisciplinary approach. To answer the first question, we use the research tradition of philosophy of science, specifically the study of mechanisms. To answer the question on formal tools, we use the research tradition of program verification and logic, specifically Separation Logic. Results: We identify several heuristics from biological sciences that cybersecurity researchers have re-invented to varying degrees. We consolidate the new mechanisms literature to yield heuristics related to the fact that knowledge is of clusters of multi-field mechanism schema on four dimensions. General knowledge structures such as the intrusion kill chain provide context and provide hypotheses for filling in details. The philosophical analysis answers this research question, and also provides constraints on building the logic. Finally, we succeed in defining an incident analysis logic resembling Separation Logic and translating the kill chain into it as a proof of concept. Conclusion: These results benefits incident analysis, enabling it to expand from a tradecraft or art to also integrate science. Future research might realize our logic into automated decision-support. Additionally, we have opened the field of cybersecuity to collaboration with philosophers of science and logicians.
URL: https://ethos.bl.uk/OrderDetails.do?uin=uk.bl.ethos.779421
Database: OpenDissertations
FullText Text:
  Availability: 0
Header DbId: ddu
DbLabel: OpenDissertations
An: ddu.oai.ethos.bl.uk.779421
AccessLevel: 6
PubType: Dissertation/ Thesis
PubTypeId: dissertation
PreciseRelevancyScore: 0
IllustrationInfo
Items – Name: Title
  Label: Title
  Group: Ti
  Data: Human decision-making in computer security incident response
– Name: Author
  Label: Authors
  Group: Au
  Data: <searchLink fieldCode="AR" term="%22Spring%2C+Jonathan+Michael%22">Spring, Jonathan Michael</searchLink>
– Name: Author
  Label: Committee Members
  Group: Au
  Data: <searchLink fieldCode="CO" term="%22Pym%2C+D%2E%22">Pym, D.</searchLink>; <searchLink fieldCode="CO" term="%22Illari%2C+P%2E%22">Illari, P.</searchLink>
– Name: Abstract
  Label: Summary
  Group: Ab
  Data: Background: Cybersecurity has risen to international importance. Almost every organization will fall victim to a successful cyberattack. Yet, guidance for computer security incident response analysts is inadequate. Research Questions: What heuristics should an incident analyst use to construct general knowledge and analyse attacks? Can we construct formal tools to enable automated decision support for the analyst with such heuristics and knowledge? Method: We take an interdisciplinary approach. To answer the first question, we use the research tradition of philosophy of science, specifically the study of mechanisms. To answer the question on formal tools, we use the research tradition of program verification and logic, specifically Separation Logic. Results: We identify several heuristics from biological sciences that cybersecurity researchers have re-invented to varying degrees. We consolidate the new mechanisms literature to yield heuristics related to the fact that knowledge is of clusters of multi-field mechanism schema on four dimensions. General knowledge structures such as the intrusion kill chain provide context and provide hypotheses for filling in details. The philosophical analysis answers this research question, and also provides constraints on building the logic. Finally, we succeed in defining an incident analysis logic resembling Separation Logic and translating the kill chain into it as a proof of concept. Conclusion: These results benefits incident analysis, enabling it to expand from a tradecraft or art to also integrate science. Future research might realize our logic into automated decision-support. Additionally, we have opened the field of cybersecuity to collaboration with philosophers of science and logicians.
– Name: URL
  Label: URL
  Group: URL
  Data: <link linkTarget="URL" linkTerm="https://ethos.bl.uk/OrderDetails.do?uin=uk.bl.ethos.779421" linkWindow="_blank">https://ethos.bl.uk/OrderDetails.do?uin=uk.bl.ethos.779421</link>
PLink https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=ddu&AN=ddu.oai.ethos.bl.uk.779421
RecordInfo BibRecord:
  BibEntity:
    Languages:
      – Code: eng
        Text: English
    Subjects:
      – SubjectFull: 004
        Type: general
    Titles:
      – TitleFull: Human decision-making in computer security incident response
        Type: main
  BibRelationships:
    HasContributorRelationships:
      – PersonEntity:
          Name:
            NameFull: Spring, Jonathan Michael
    IsPartOfRelationships:
      – BibEntity:
          Dates:
            – D: 01
              M: 01
              Type: published
              Y: 2019
ResultId 1