Knowledge management for incident response teams

Mariami Gonashvili, B.Sc.

Master's thesis

Abstract:

Computer security incident response teams provide the first line of defense for security incidents. Timely response is highly important to contain incidents as soon as possible. Therefore, effective knowledge management in the incident response team is highly important.The concept of knowledge management has also gained the interest of many big organizations, because proper knowledge management improves the performance of business processes. This thesis focuses on knowledge management in Incident Response teams. It suggests a customized knowledge management frame-work for the Computer Security Incident Response Team of MU based on a literature review of state-of-the-art knowledge management frameworks and the business process of the respective incident response team. This customized framework is applied in practice in order to identify and find solutions for the knowledge requirements for the incident response team. By closely reviewing the incident handling process as a whole, the so-called "knowledge gaps" were identified. Several solutions were considered and compared and finally turned into a prototype knowledge management system. The system that was already used by the incident handling team was ex-tended to centralize relevant documentation and automate processes that would otherwise require manual work and cause delays. This will help the operational team to efficiently communicate information and guarantee an optimized work-flow.

Keywords

CSIRT-MU, Incident handling, knowledge, knowledge management, knowledge management systems, RT/RTIR, RT articles

Language used: English

Date on which the thesis was submitted / produced: 17. 5. 2019

Thesis defence

• Date of defence: 20. 6. 2019
• Supervisor: RNDr. Jan Vykopal, Ph.D.
• Reader: Mgr. Ing. Jakub Čegan

Masaryk University

Faculty of Informatics

Master programme / field:
Informatics / Information Technology Security (eng.)