1. Security Incident Handling and Organisational Models Hossein Hayati Karun Autumn 2006 Gjøvik University College

2. Research questions How to measure the efficiency of routines for security incident handling in two organisational models? How to increase the efficiency of routines for handling security incidents?

3. Organisational models HierarchicMatrix

4. Organisation charts (1/2) Samples of hierarchical structures 12 employees with total capacity of 110 16 employees with total capacity of 165 25 employees with total capacity of 265

5. Organisation charts (2/2) Samples of matrix structures 12 employees with total capacity of 110 16 employees with total capacity of 165 25 employees with total capacity of 265

6. Network flow theorem Menger’s theorem can be interpreted in the network flow context in the following way: The maximum amount of flow in a network is equal to the capacity of a minimum cut.

7. Graph capacity Each edge is assigned with an integer The integer indicates the edge’s capacity For instance: a  d = 5

8. Computing the max flow 1.S  a = 5 2.a  d = 5 3.d  g = 5 4.g  T = 5 Flow capacity = 5

9. Maximum flow Computing the max flow FromToCapacity Sa5 ad5 dg5 gT5 Sb3 be3 eh3 hT3 Sc2 ce2 eg2 gT2 FromToCapacity Sc2 ce2 eh2 hT2 Sc1 cf1 fh1 HT1 Max flow = 13

10. Minimum cut Computing the min cut 9 min cuts (green lines) A = 5 + 3 + 5 = 13 B = 5+3+4+1 = 13 D = 1+5+2+5 = 13 E = 1+4+3+0+5 = 13 … Min cut = 13

11. Max flow – min cut The maximum amount of flow in a network is equal to the capacity of a minimum cut. Max flow = Min cut = 13

12. Ford-Fulkerson’s algorithm Advantages: Simplicity during the implementation high speed of the algorithm requires little processor power Disadvantage: the insignificant probability of not returning a value which means not being able to calculate the flow capacity

13. The prototype Computes max flow Developed in C# Basen on FF’s algo Textual presentation Graphical presentation

14. 2 sets of data files (12 files) 1.Solved security incidents Employees: Same capacity as in 2. Managers: Lower security incidents solving capacity than employees 2. Reported security incidents Employees: same capacity as in 1. Managers: Higher reporting capacity than solving security incidents

15. Results of our experiment Solved security incidents –Hierarchic structure –Matrix structure Reported security incidents –Hierarchic structure –Matrix structure

16. Nodes and edges

17. Solved security incidents in hierarchical structure

18. Solved security incidents in matrix structure

19. Reported security incidents in hierarchical structure

20. Reported security incidents in matrix structure

21. Solved security incidents in hierarchical and matrix structure

22. Reported security incidents in hierarchical and matrix structure

23. Conclusion 1.Matrix organisational model are a more efficient organisational model than the hierarchical model, both in solving and reporting security incidents. 2.Increasing the efficiency of routines for handling security incidents does not depend on the organisations’ size, but rather the organisations’ model. 1. Using network flow capacity 2. Reorganise to matrix structure

24. Usefulness … Eases the computation of max flow Personnel dealing with security organisation, security management … Computing max flow when any changes like merging or dividing companies or department take place Testing other organisational models

25. Thanks to … Professor Slobodan Petrovic Monica Strand Kristiansen Brita Vesterås And all of you Any question?