Evaluating Incident Response in CSIRTs using Cube Socio-technical Systems Analysis

Haula Sani Galadima, Cormac J. Doherty, Nick McDonald, Junli Liang, Rob Brennan

Abstract: Highlights•We use Cube Socio-Technical Systems Analysis (STSA) to evaluate IR teams with Access Risk Knowledge (ARK) platform.•We developed a specialized IR Cube questionnaire and created open ARK ontologies for the IR domain.•A case study of a large accredited CSIRT was conducted using a multi-stage Cube STSA.•Challenges identified include lack of daily reviews and inconsistent documentation of IR communication.•Knowledge base was assessed for Findable, Accessible, Interoperable, Reusable (FAIR)ness.