Information security incident management and analysis service

Abstract

Objective. The paper considers the issues of designing and developing a service for automating the management and analysis of information security incidents for a metallurgical enterprise. The main stages and actions of incident management at the enterprise are examined and described. Methods. A software service that allows you to automate the processes of monitoring, evaluating and analyzing undesirable and unexpected information security events has been developed in the Visual Studio Code environment in the high-level Python programming language. To expand the functionality of the created software application, additional frameworks and the necessary libraries were used. The storage of information about the company's incidents is organized in the created database. Result. The article describes the algorithm for developing a software service, and provides examples of screen forms of this application. The functionality of the service allows you to receive various analytics: a general and detailed analysis of incidents by type, detection methods, time spent on solving the incident, the level of criticality, status, method of detection, speed of response, and the consequences caused. Conclusion. Testing of the software service demonstrated effective detection of new attacks and prompt protection of information systems and automated equipment of the enterprise. Incident analysis is aimed at identifying problem areas in the work of information security services, the elimination of which will allow for faster detection of unwanted events and minimization of the recurrence of incidents and their consequences.