METHODOLOGY FOR INVESTIGATING INFORMATION SECURITY INCIDENTS
Diana Tsyrkaniuk, Volodymyr Sokolov · Cybersecurity Education Science Technique · 2024
The development and implementation of a comprehensive information security strategy during times of war are critical tasks for ensuring national security and protecting vital resources and information. The article analyzes various types of incidents in the field of information security, their mitigation, and recovery methods. It demonstrates the mechanics of investigating information security incidents at stages such as monitoring, indexing, data collection, mitigation, recovery, and closure. The publication presents a formalized description of an incident-handling plan in the form of a state machine, enabling the systematization and automation of the incident response process. Using examples of attacks targeting critical infrastructure, it illustrates the application of this mechanism and identifies measures aimed at enhancing the information security system, which can be employed to protect both governmental and commercial institutions and organizations. As a result, the recommended strategies for effectively countering cyberattacks and ensuring information security for organizations or nations include the implementation of monitoring tools and coordination with governmental and international response teams. It is also crucial to regularly train employees and develop mechanisms for collaboration with partners to achieve efficient protection against cyber threats. These measures contribute to strengthening cybersecurity and reducing potential damages. Future research may encompass the development of new threat detection algorithms, evaluating the effectiveness of information security measures for governmental and commercial institutions, implementing automated incident response systems, as well as studying the impact of war on critical infrastructure and international cooperation in this field, exploring opportunities for international cooperation and information exchange in the realm of information security during conflicts for the collective defense of national interests.