Basic performance parameters for cyberincidents response teams

Abstract

The main stages of information security incidents management are responding and investigation. These functions are assigned to specialized teams and centers (such as CERT – Computer Emergency Response Team). The information security level of organization and whole state depends on CERT`s performance. The analysis showed that CERT`s performance assessment is not carried out properly. That’s why in this paper basic performance parameters for cyberincidents response teams – it gives a possibility to assess CERT`s performance during necessary period. The report on these parameters should be performed regularly such as once a week (month, year etc.) to obtain a complete picture of their changes and identify key trends. Using the obtained parameters will enable: to make quick management decisions, evaluate the level of CERT`s specialists, to improve the CERT efficiency, to reduce losses associated with incidents, to improve user productivity, to use staff effectively and others. As well by influencing on the CERT`s specialists actions and their correction can improve information security level of organization and whole state. Further on the basis of these parameters it is planned to develop mathematical models to ensure continuous improvement of the cyberincidents management.