Workflow based security incident management

Belsis, MA; Simitsis, A; Gritzalis, S

dc.contributor.author	Belsis, MA	en
dc.contributor.author	Simitsis, A	en
dc.contributor.author	Gritzalis, S	en
dc.date.accessioned	2014-03-01T02:43:47Z
dc.date.available	2014-03-01T02:43:47Z
dc.date.issued	2005	en
dc.identifier.issn	0302-9743	en
dc.identifier.uri	https://dspace.lib.ntua.gr/xmlui/handle/123456789/31505
dc.subject	Computer Security	en
dc.subject	Database Management System	en
dc.subject	Law Enforcement	en
dc.subject	Management System	en
dc.subject.classification	Computer Science, Theory & Methods	en
dc.subject.other	Computer architecture	en
dc.subject.other	Database systems	en
dc.subject.other	Information analysis	en
dc.subject.other	Mathematical models	en
dc.subject.other	Mathematical transformations	en
dc.subject.other	Software engineering	en
dc.subject.other	Computer Security Incident Response Teams (CSIRTs)	en
dc.subject.other	Incident management	en
dc.subject.other	Security incident management	en
dc.subject.other	Security of data	en
dc.title	Workflow based security incident management	en
heal.type	conferenceItem	en
heal.identifier.primary	10.1007/11573036_65	en
heal.identifier.secondary	http://dx.doi.org/10.1007/11573036_65	en
heal.language	English	en
heal.publicationDate	2005	en
heal.abstract	Security incident management is one of the critical areas that offers valuable information to security experts, but still lacks much development. Currently, several security incident database models have been proposed and used. The discrepancies of such databases entail that worldwide incident information is stored in different formats and places and, so, do not provide any means for Computer Security Incident Response Teams (CSIRTs) collaboration. This paper presents an architecture based on advance database techniques, able to collect incident related information from different sources. Our framework enhances the incident management process by allowing the law enforcement units to (a) collect the required evidence from incident data that are spread through a number of different incident management systems; (b) transform, clean, and homogenize them; and, finally, (c) load them to a central database management system. Such architecture can also be beneficial by minimizing the mean time between the appearance of a new incident and its publication to the worldwide community. © Springer-Verlag Berlin Heidelberg 2005.	en
heal.publisher	SPRINGER-VERLAG BERLIN	en
heal.journalName	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)	en
heal.bookName	LECTURE NOTES IN COMPUTER SCIENCE	en
dc.identifier.doi	10.1007/11573036_65	en
dc.identifier.isi	ISI:000233675500065	en
dc.identifier.volume	3746 LNCS	en
dc.identifier.spage	684	en
dc.identifier.epage	694	en