Security Incident Handling and Organisational Models Hossein Hayati Karun Autumn 2006 Gjøvik University College

Research questions How to measure the efficiency of routines for security incident handling in two organisational models? How to increase the efficiency of routines for handling security incidents?

Organisational models HierarchicMatrix

Organisation charts (1/2) Samples of hierarchical structures 12 employees with total capacity of employees with total capacity of employees with total capacity of 265

Organisation charts (2/2) Samples of matrix structures 12 employees with total capacity of employees with total capacity of employees with total capacity of 265

Network flow theorem Menger’s theorem can be interpreted in the network flow context in the following way: The maximum amount of flow in a network is equal to the capacity of a minimum cut.

Graph capacity Each edge is assigned with an integer The integer indicates the edge’s capacity For instance: a  d = 5

Computing the max flow 1.S  a = 5 2.a  d = 5 3.d  g = 5 4.g  T = 5 Flow capacity = 5

Maximum flow Computing the max flow FromToCapacity Sa5 ad5 dg5 gT5 Sb3 be3 eh3 hT3 Sc2 ce2 eg2 gT2 FromToCapacity Sc2 ce2 eh2 hT2 Sc1 cf1 fh1 HT1 Max flow = 13

Minimum cut Computing the min cut 9 min cuts (green lines) A = = 13 B = = 13 D = = 13 E = = 13 … Min cut = 13

Max flow – min cut The maximum amount of flow in a network is equal to the capacity of a minimum cut. Max flow = Min cut = 13

Ford-Fulkerson’s algorithm Advantages: Simplicity during the implementation high speed of the algorithm requires little processor power Disadvantage: the insignificant probability of not returning a value which means not being able to calculate the flow capacity

The prototype Computes max flow Developed in C# Basen on FF’s algo Textual presentation Graphical presentation

2 sets of data files (12 files) 1.Solved security incidents Employees: Same capacity as in 2. Managers: Lower security incidents solving capacity than employees 2. Reported security incidents Employees: same capacity as in 1. Managers: Higher reporting capacity than solving security incidents

Results of our experiment Solved security incidents –Hierarchic structure –Matrix structure Reported security incidents –Hierarchic structure –Matrix structure

Nodes and edges

Solved security incidents in hierarchical structure

Solved security incidents in matrix structure

Reported security incidents in hierarchical structure

Reported security incidents in matrix structure

Solved security incidents in hierarchical and matrix structure

Reported security incidents in hierarchical and matrix structure

Conclusion 1.Matrix organisational model are a more efficient organisational model than the hierarchical model, both in solving and reporting security incidents. 2.Increasing the efficiency of routines for handling security incidents does not depend on the organisations’ size, but rather the organisations’ model. 1. Using network flow capacity 2. Reorganise to matrix structure

Usefulness … Eases the computation of max flow Personnel dealing with security organisation, security management … Computing max flow when any changes like merging or dividing companies or department take place Testing other organisational models

Thanks to … Professor Slobodan Petrovic Monica Strand Kristiansen Brita Vesterås And all of you Any question?