A Capability Driven Automated Cybersecurity Monitoring and Response System

Vladislavs Minkevics^*Jānis Grabis

• Riga Technical University, Riga, Latvia

Organizations face a variety of cybersecurity threats, and implementation of security management solutions is a challenging task. This paper proposes to implement such solutions in an incremental manner starting with key requirements and adding new modules as necessary. A set of key requirements with a focus on cybersecurity threat monitoring and response automation are identified. The capability driven approach is used to describe these requirements in a structured manner. That enables organizations to identify required security management capabilities in alignment with organizational goals. A cybersecurity monitoring and response system is developed on the basis of the capability model. The system uses machine learning models to identify cybersecurity threats, and appropriate response mechanisms are invoked to deal with the threats. It is shown that selection of the right adjustments defined in the capability model significantly affects cybersecurity management efficiency. The use of the machine learning models also allows to adapt the system to handling new cybersecurity threats. The cybersecurity monitoring and response system is compared with the state of the art commercial systems and it is shown to achieve a comparable performance while providing a higher level of flexibility.