SOTER, ¹ a cybersecurity incident management playbook, is developed to provide a comprehensive model to manage cybersecurity incidents, particularly for the cybersecurity operations center. The proposed playbook is adaptive, cross-sectorial, and process driven. Each key components of the incident management playbook are outlined and discussed. Furthermore, a lexicon based on equivalence mapping is developed and used to map existing cybersecurity incident vocabulary and taxonomy into a common and consistent lexicon to aid understanding among incident management stakeholder communities—national, government, and private sectors. A versatile workbook model has been explored, which proves to be adaptable to serve a wide range of cases for successfully managing government and private sector security operations center. Cybersecurity incident sharing partnership, formalism for metric and measurements of cybersecurity incident parameters, and cybersecurity incident classification and prioritization schemes are presented, and finally, cybersecurity incident “plays” and playbook templates are discussed.

Social engineering (SE) attacks are a growing concern for organizations that rely on technology to protect sensitive data. Identifying and preventing these attacks can be challenging, as they frequently rely on manipulating human behavior rather than exploiting technical vulnerabilities. Although various studies have explored SE attacks and their defense mechanisms, there remains a gap in the literature concerning the holistic and layered classification of these threats and countermeasures. To address this, we conducted a comprehensive literature survey to understand existing taxonomies and subsequently identified areas that required a more structured and exhaustive categorization. Based on the survey results, we propose a comprehensive taxonomy of SE attacks, classifying them based on three levels: environment, approaches, and mediums. Additionally, we present a taxonomy of social engineering countermeasures, encompassing both technical and non-technical solutions. The proposed taxonomies serve as a foundation for future research and offer organizations a valuable framework for developing effective strategies to detect, prevent, and respond to social engineering incidents.

An intrusion detection system (IDS) perform postcompromise detection of security breaches whenever preventive measures such as firewalls do not avert an attack. However, these systems raise a vast number of alerts that must be analyzed and triaged by security analysts. This process is largely manual, tedious, and time-consuming. Alert correlation is a technique that reduces the number of intrusion alerts by aggregating alerts that are similar in some way. However, the correlation is performed outside the IDS through third-party systems and tools, after the IDS has already generated a high volume of alerts. These third-party systems add to the complexity of security operations. In this paper, we build on the highly researched area of alert and event correlation by developing a novel hierarchical event correlation model that promises to reduce the number of alerts issued by an intrusion detection system. This is achieved by correlating the events before the IDS classifies them. The proposed model takes the best features from similarity and graph-based correlation techniques to deliver an ensemble capability not possible by either approach separately. Further, we propose a correlation process for events rather than alerts as is the case in the current art. We further develop our own correlation and clustering algorithm which is tailor-made to the correlation and clustering of network event data. The model is implemented as a proof of concept with experiments run on standard intrusion detection sets. The correlation achieves an 87% data reduction through aggregation, producing nearly 21,000 clusters in about 30 s.

Purpose: Changing scattered and dynamic business rules in business workflow systems has become a growing problem that hinders the use and configuration of workflow-based applications. There is a gap in the existing research studies which currently focus on solutions that are application specific, without accounting for the universal logical dependencies between the business rules and, as a result, do not support adaptation of the business rules in real time. The paper aims to discuss this issue. Design/methodology/approach: To tackle the above problems, this paper adopts a bottom-up approach, which puts forward a component model of the business process workflows and then adds business rules which have clear logical semantics. This allows incremental development of the workflows and semantic indexing of the rules which govern them during the initial acquisition. Findings: The paper introduces an event-driven model for development of business workflows which is purely logic-based and can be easily implemented using an object-oriented technology, together with a model of the business rules dependencies which supports incremental semantic indexing. It also proposes a two-level inference mechanism as a vehicle for controlling the business process execution and the process of adaptation of the business rules at real time based on propagating the dependencies. Research limitations/implications: The framework is strictly logical and completely domain-independent. It allows to account both synchronous and asynchronous triggering events as well as both qualitative and quantitative description of the conditions of the rules. Although our primary interest is to apply the framework to the business processes typical in the construction industry we believe our approach has much wider potential due to its strictly logical formalization and domain independence. In fact it can be used to control any business processes where the execution is governed by rules. Practical implications: The framework could be applied to both large business process modelling tasks and small but very dynamic business processes like the typical digital business processes found in online banking or e-Commerce. For example, it can be used for adjusting security policies by adding the capability to adapt automatically the access rights to account for additional resources and new channels of operation which can be very interesting ion both B2C and B2B applications. Social implications: The potential scope of the impact of the research reported here is linked to the wide applicability of rule-based systems in business. Our approach makes it possible not only to control the execution of the processes, but also to identify problems in the control policies themselves from the point of view of their logical properties – consistency, redundancies and potential gaps in the logics. In addition to this, our approach not only increases the efficiency, but also provides flexibility for adaptation of the policies in real time and increases the security of the overall control which improves the overall quality of the automation. Originality/value: The major achievement reported in this paper is the construction of a universal, strictly logic-based event-driven framework for business process modelling and control, which allows purely logical analysis and adaptation of the business rules governing the business workflows through accounting their dependencies. An added value is the support for object-oriented implementation and the incremental indexing which has been possible thanks to the bottom-up approach adopted in the construction of the framework.