Incident Investigation Methodology for Access Violations in Information Systems
Maxim Gorda, Andrey Alexeevich Chechulin, Igor Vitalievich Kotenko · 2025
This paper presents a comprehensive methodology for investigating incidents related to access violations in information systems. With the increasing number of cyberattacks targeting organizations’ credentials and internal data, there is a pressing need for a well-structured approach to digital forensics. The methodology proposed herein covers various stages of the investigation process, including the analysis of authentication policies, system logs, and compensatory measures following an incident. The scientific novelty of this work lies in its focused approach to a specific type of attack, expanding the methodology to address the unique characteristics of access rights violations. The effectiveness of this approach has been demonstrated in practice, providing a reliable tool for security professionals.