The future of information security incident management training: A case study of electrical power companies

Abstract

Recent attacks and threat reports indicate that industrial control organizations are attractive targets for attacks. Emerging threats create the need for a well-established capacity for responding to unwanted incidents. Such a capacity is influenced by organizational, human, and technological factors. We have conducted extensive fieldwork for 2.5 years in Norwegian electric power companies with the aim of identifying challenges for improving information security incident management practices. Semi-structured interviews, document analysis, a survey and participant observations have been performed as part of this case study.We describe how training for responding to information security incidents is given low priority and that different types of personnel, such as business managers and technical personnel, have different perspectives and priorities in regard to information security. Moreover, there is a gap in how IT staff and control system staff understand information security. Furthermore, cross-functional teams need to be created to ensure a holistic view during the incident response process.To improve the capacity for responding to incidents, organizations need regular training sessions and systematic evaluations after such sessions. There is also the potential for improvement in evaluating minor incidents. A transition from an ad hoc approach to a systematic approach in training and learning requires a reorientation not only by the electric power companies but also by management. We found that learning to learn will enable the organizations to improve their incident response practices. * Corresponding author Email addresses: maria.bartnes@item.ntnu.no (Maria Bartnes), nils.b.moe@sintef.no (Nils Brede Moe), poul.heegaard@item.ntnu.no (Poul E. Heegaard)

The effects of organizational learning on the security of bankings information system in Indonesia

“…The results of this study support the research of Bartnes et al (2016) who say that learning will enable organizations to improve response practices for incidents. Mattia (2011) said learning can help organizations to adapt and manage the process of securing organizational assets, and Kovacich (2016) states that system security is one of the fastest growing things now, the internet as a core infrastructure is the target of attacks, so organizations must have knowledge which is good for dealing with cyber-attacks through learning.…”

Auditorías en Ciberseguridad: Un modelo de aplicación general para empresas y naciones

“…Algunos autores prefieren diseñar sus casos de estudio utilizando la metodología de investigación de Yin (2009). Bartnes & Brede (2016) presentaron su investigación utilizando la recopilación de datos, el análisis de datos, las secciones de escenarios y contenido de casos. Meszaros & Buchalcevova (2016) diseñaron el Marco de Seguridad de Servicios Online (OSSF) y sus métodos de investigación se organizaron en un proceso con las siguientes actividades:…”

Challenges in IT security preparedness exercises: A case study

“…The specific nature of the assistance required depends on both the technical and business impact of the threat. To understand the gaps in the knowledge and how to design the organization to support the response unit, organizations need to perform exercises frequently and evaluate their outcome (Bartnes et al, 2016).…”