# InCReASE: A Dynamic Framework Towards Enhancing Situational Awareness in Cyber Incident Response

Jarl Andreassen, Martin Eileraas, Lucia Castro Herrera, Nadia Saad Noori

## ► To cite this version:

Jarl Andreassen, Martin Eileraas, Lucia Castro Herrera, Nadia Saad Noori. InCReASE: A Dynamic Framework Towards Enhancing Situational Awareness in Cyber Incident Response. 7th International Conference on Information Technology in Disaster Risk Reduction (ITDRR), Oct 2022, Krisitansand, Norway. pp.230-243, 10.1007/978-3-031-34207-3_15. hal-04680531

HAL Id: hal-04680531

https://inria.hal.science/hal-04680531v1

Submitted on 28 Aug 2024

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# InCReASE: A Dynamic Framework Towards Enhancing Situational Awareness in Cyber Incident Response

Jarl Andreassen, Martin Eileraas, Lucia Castro Herrera[0000-0002-6254-8720], and Nadia Saad Noori[0000-0001-5271-4599]

University of Agder, Centre for Integrated Emergency Management, Norway
lucia.c.herrera@uia.no

**Abstract** Protecting valuable IT assets is one of the most significant challenges that organizations face today. Cyber criminals operating beyond physical boundaries, are able to disrupt and destroy cyber infrastructure, deny organizations access to IT services, and steal sensitive data. In response, enterprises organize security operations centres at the heart of their entities with the purpose of employing socio-technical systems with capabilities to detect, analyze and respond to these threats. This exploratory study examines how such capabilities are operationalized in leading "Managed Security Service Providers" (MSSPs) providing cybersecurity operations and incident response, and looks at how situation awareness knowledge is constructed through the organizational levels of the enterprise detection and response. In this context, situational awareness span over different levels in the organization starting from team personnel, ending at top management. Our work contributes to situational awareness theory in the context of cybersecurity operations and incident response. Thus, we advance the understanding of the organizational capabilities of MSSPs to develop awareness of the cyberthreat landscape and the broader operational dynamics. By introducing InCReASE, a dynamic framework towards enhancing situation awareness in Security Operations Centers (SOC) operations and incident response; we extend existing situational awareness models, combining elements of the existing body of knowledge and our empirical findings. The presented work is a reflection on the best practices adopted by MSSPs organizations operating in Norway.

**Keywords:** Situational awareness · Cyber incident management · Cybersecurity situation awareness · Crisis information flow · Crisis response

## 1 Introduction

Cybersecurity threat actors have risen to become increasingly sophisticated, persistent and organized, posing a substantial threat to modern organizations [1]. As stated by the 2021 Verizon data breach investigations report (DBIR), external threat actors in 2020 perpetrated 80 percent of recorded data breaches, with
likewise 80 percent of *top threat actor varieties* in breaches committed by organized crime groups [30]. Human attackers who are well-informed, well-trained and methodical, use sophisticated tools and techniques to disrupt and destroy critical cyber-infrastructures; deny organizations access to their own IT infrastructure and services; and steal sensitive data such as intellectual property, trade secrets, and customer data. As a result, organizations may suffer from a loss of competitive advantage, productivity, reputation, and customer confidence, as well as legal penalties and direct financial loss [1].

The growing dependency on the cyberspace increasingly demands the need for situational awareness —essentially, perceiving and understanding the operational environment and accurately predicting and responding to problems that might occur [20]. Situational awareness is the process of obtaining relevant information related to the organization that is integrated into usable intelligence and re-disseminated to support informed decision making [16]. The systems and networks that operate in the cyberspace have vulnerabilities that present significant risks to both individual organizations and national security. By anticipating what might happen to these systems, organizations can develop effective countermeasures to protect their critical operations and services. Hence, situational awareness span over different levels in the organization starting from the cybersecurity team personnel, ending at the top management level. Thus, the provision of situational awareness at the different organizational levels is considered a complex process involving various sources of information, different levels of perspective, and different interpretations which trigger a complex set of decision making processes [20].

As incident response and crisis management becomes more reliant on the advances of technology, the sociotechnical system must adapt to respond to the capabilities and challenges of new technologies. Therefore, the human component is just as up-to-date as the technology [25]. With this in mind, we therefore pose the following research question addressing the practical perspective of situational awareness: "How is situational awareness knowledge constructed through the organizational levels of the Managed Security Service Providers (MSSPs)?".

The goal of this exploratory study is to develop an understanding of the concept of situational awareness and its relation to cyber-incident response; investigate its function in the context of enterprise MSSP cyber-incident response operations and examine how situational awareness knowledge is constructed through the organizational hierarchy in an MSSP enterprise. As a result, a conceptual dynamic framework is developed and validated in a Norwegian context [8]. The framework is expected to contribute to illustrating best practices in security operations teams.

The following sections of this article are organized as follows: section 2 presents a background and work related to our area of study that defines our focus. Section 3 describes our research approach. Section 4 summarizes and discusses our findings, while section 5 concludes.
## 2 Background and related work

Following a systematic literature review (SLR) method aligned with [18], we investigated the intersection between situational awareness, cybersecurity and organizations. Therefore, this section discusses the concepts and theoretical grounding resulted from the review of the existing body of knowledge. We present background concepts and a theoretical lens that frames and informs the formulation of a conceptual framework.

### 2.1 The role of cybersecurity in organizations

Cybersecurity is the practice of protecting an organization's IT-related assets, including data, systems and networks, from digital attacks that may access, destroy, or change sensitive information or disturb business operations [15]. Cybersecurity involves the convergence of people, processes and technology to protect organizations, individuals or networks from digital attacks. Organizations have the responsibility to manage and preserve sensitive data while providing services to their customers and users. Therefore, organizations are called to allocate adequate resources to ensure data protection and encourage a security culture to ensure that data and internal processes are managed responsibly [2], following the principles of confidentiality, integrity and availability [29].

New threats develop on a regular basis, and each organization must ensure that it is prepared to deal with a constantly changing threat landscape. Even though organizations have significantly increased investments in cybersecurity, incident occurrences continue to rise [1]. In order to detect intrusions efficiently, a monitoring network is required with a global view. This is only possible with an architecture that can collect data from all sources. This task is usually assigned to a Security Operation Center (SOC) [4].

### 2.2 Security Operations Center (SOC) & Incident Response (IR)

A SOC is an organizational entity located at the heart of all security operations. The SOC is a complex structure that manages and improves an organization's total security posture. SOC's key functions are to detect, analyze, and respond to cybersecurity threats and cyber incidents by employing technology, people and processes [31].

On an abstract level, SOCs can be structured as centralized, distributed, or decentralized entities. A centralized architecture in the context of SOCs refers to the approach in which all data is transferred from various locations or subsidiaries to a single central SOC for processing. A distributed SOC resembles one single system operating across several subsidiary companies. Users have the impression that they are interacting with one single entity. All entities can retrieve, process, integrate, and deliver security information and services to other entities using the distributed system. A decentralized SOC is made up of a few
SOCs of possibly limited capability that report to one or more central SOCs [31]. Moreover, the choice of architecture should formalize the operation model of the SOC in terms of components and relationships [21].

## 2.3 Roles and responsibilities

Depending on the scope and size of the SOC, different security operations teams are needed in different scales. Different tiers of analysts, as well as dedicated managers, are typical core positions within the operational hierarchy:

- **Tier 1** analysts are primarily in charge of gathering raw data and assessing alarms and alerts from system monitoring tools. They confirm, determine, or revise the criticality of alerts, as well as add important data to them [31].

- **Tier 2** analysts evaluate the more serious security incidents escalated by tier 1 analysts and conduct a more in-depth analysis using threat intelligence (Indicators of Compromise (IOC), updated rules, etc.). They must comprehend the scale of an incident and be aware of the systems that are affected on a higher level [31].

- **Tier 3** analysts are the most experienced members of a SOC's workforce. At this level, analysts must also analyze all significant security alerts, threat intelligence, and other security data provided by tier 1 and tier 2 analysts [31].

- **SOC Managers** oversee the security operations team. They provide technical assistance as needed, but most importantly, they are responsible for effectively managing the team. Evaluating team members, developing processes, assessing incident reports, and developing and implementing necessary crisis communication plans are all part of the job. They also assist with security audits, and report to the Chief Information Security Officer (CISO) or other top-level management positions [31].

It is worth noting that modern enterprise SOCs are hierarchically structured around SIEM (Security Information and Event Management) systems that allow the management and completion of key security functions with emphasis on preparation, detection and analysis processes [3].

## 2.4 Security Information and Event Management (SIEM)

One of the SOC's key functions is to monitor security related events from the enterprises' technology environments, including the IT network perimeter defense systems such as application servers, firewalls, databases, intrusion prevention devices, and user accounts. Each asset might be monitored using a variety of sensors and maintain log files of activity. The SOC receives event information from the sensors and log files and triggers alerts indicating possible malicious behavior, both at the perimeter of the network and in the enterprise [3]. In the wake of complex security events, SIEM has replaced Intrusion Detection and
Prevention Systems (IDPS) to fulfill these goals [5]. SIEM systems are an important tool used in SOCs as they collect security events from numerous and diverse sources in enterprise networks, standardize the events to a common format, store the conformed events for forensic analysis, and correlate the events to identify malicious activities in real time [3]. They have evolved into comprehensive systems that provide a broad view of high-risk areas and proactively focus on mitigation measures aimed at lowering incident response costs and time [13].

While SIEM systems provide control over networks and systems, to be able to gain a knowledge advantage over cyber threat actors and anticipate potential threats and risks, SOC personnel needs to turn their attention into the operational environment and the current threat picture. Thus, the effectiveness of a SOC depends on its access to actionable threat intelligence among many dependencies [3].

## 2.5 Cyber threat intelligence (CTI)

The volume of cyber attacks and malware varieties has risen significantly in recent years, making it increasingly challenging for security analysts and forensic investigators to discover and protect against cybersecurity threats. To address this issue, researchers coined the term "Threat Intelligence" which refers to "the set of data collected, assessed and applied in relation to security threats, threat actors, exploits, malware, vulnerabilities, and compromise indicators" [6]. CTI provides knowledge of a malicious actor's capabilities, infrastructure, motives, goals, and resources in cyberspace [17]. In fact, CTI was established to support security practitioners in recognizing the indicators of cyber threats, extracting information about the attack techniques, and, as a result, accurately and swiftly responding to a given attack [6]. The primary goal of CTI is to gain a knowledge advantage over cyber threat actors. CTI accelerates the detection of malicious behavior at the tactical and operational levels, ideally before a malicious actor gains a foothold in the network. On a Strategic level, CTI helps decision-makers make sense of and gain insight into the relevant threat environment [26]. The use of threat intelligence enables an organization to prioritize defenses around prized assets, focusing on vulnerabilities and ways that an adversary activity can be mitigated [17, 32] consequently states that CTI is not simply information, it is information that has been analyzed and is actionable.

## 2.6 Information exchange

Reducing cybersecurity risk by enhancing cyber situational awareness in organizations increasingly depends on information sharing and collaboration among a wide range of actors, leveraging many different models, methods, and mechanisms. Information sharing is the process of sharing information about cybersecurity incidents, threats, vulnerabilities, best practices, mitigation measures and other topics [14]. Sharing of CTI is an effective way of enhancing the situation
awareness of an organization and its stakeholders [32]. Moreover, to survive cur-
rent and future attacks, organizations need to dedicate resources and efforts in
prevention by working proactively instead of solely reactive. In the future, or-
ganizations could benefit from implementing a threat intelligence program and
disclose their knowledge intra- and inter-organizationally as part of proactive cy-
bersecurity. Stakeholders may be held responsible in the future for not sharing
known threats that could affect others resulting in a breach. The core idea behind
threat intelligence sharing is to create situation awareness among stakeholders
through sharing information about the newest threats and vulnerabilities, and
to swiftly implement the remedies [32]. In cybersecurity, receiving the right in-
formation at the right time can empower decision-makers to reduce risks, deter
attackers, and enhance resilience. Sharing the right information is more than
people exchanging data, it is also about the automation of machine-to-machine
sharing to counter fast-moving threats [14]. Within the concepts of CTI man-
agement and especially information sharing, several authors ([19]; [1]; [24]; [28])
promote the concept of inter-organizational sharing networks for exchange of
threat intelligence information, primarily by the use of SOCs. This gives orga-
nizations a considerable advantage when fighting against cyber threats [1].

2.7 Cybersecurity situation awareness

The widely applied and most common definition of situation awareness is that of [9], which from a cognitive point of view defines SA as “*the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning and the projection of their status in the near future*”. [9] describes SA as part of a larger process for human cognition that is framed from an information-processing perspective. It is apparent in the literature, that authors most of the time refer to and "translate" Endsley's conceptualization into their own perspective when defining SA in cybersecurity.

For example, [10] states that "building situation awareness requires capability
to gather information from the environment, means to understand gathered in-
formation, and reflecting the gained understanding for the current environment"
[10]. Here - gather, understand and reflect are synonyms for perceive, compre-
hend and project. Furthermore, [1] defines SA in incident response as "the per-
ception of incident-related elements within the organizational environment over
the course of the incident, the comprehension of their meaning within the context
of the organization's cybersecurity mission and objectives, and the projection of
their status in the near future" - Here, the body of the definition is altered to fit
the dynamics and attributes of organizational incident response perspective and
environment. Consequently, [1] offer a more comprehensible example, framing
SA as "a problem of collecting relevant and useful information (i.e. 'collect the
dots'), fusing together key elements of the information (i.e. 'connect the dots')
and deriving insights from the fused information ('project from the dots')" - much
like how [27] compares SA to knitting pieces of a puzzle together. You collect
the pieces ('the dots'), connect them and reflect upon the picture that emerges. Simultaneously, collecting and connecting the pieces of the puzzle are synonyms for perceiving and comprehending, while the finished puzzle represents insight of the environment of which an operator can reflect upon (projection) to inform decision-making. Moreover, [11] adds, based on the conceptualization of Endsley that "*the words "perception", "comprehension", and "projection" within cyber-security can be taken to denote progressively increasing awareness levels ranging from (i) basic perception of important data, (ii) interpretation and combination of data into knowledge, and (iii) the ability to predict future events and their implications*".

## 3 Research approach

Through this exploratory study we develop an understanding of the concept of situation awareness (SA) and its relation to cybersecurity. In addition, we investigate the role of SA in the context of enterprise MSSP cybersecurity operations and examine how knowledge is constructed through the organizational levels of the enterprise, namely, strategic, tactical and operational. The choice of research design relates to the nature of the research problem and the type of knowledge information required to answer the research questions [7]. Thus, an interpretive qualitative approach [22] was adopted with the aim to develop an understanding of the SA and its relation to cybersecurity and investigate its function in the context of cyber incident management.

This exploratory study examines how leading MSSP organizations are operationalized to provide security operations as a service while catering to the needs of SA. A MSSP provides outsourced monitoring and management of security devices and systems. Common services are managed firewall, intrusion detection, virtual private network, vulnerability assessment, and anti-viral services. MSSPs leverage high-availability security operation centers (either their own or from other data center providers) to provide 24/7 services aimed at reducing the number of operational security personnel an organization needs to hire, train, and retain in order to maintain an acceptable security posture [12].

In this article, we studied two large multinational and leading IT consultancy companies, MSSP1 and MSSP2 worth forty billion (4.4 billion USD) and forty-two billion NOK (4.5 billion USD) respectively. MSSP1 Operates in 7 countries and counts with more than 7,500 personnel. This company offers a full range of hardware and software from the world's top technology companies and help customers solve problems and get maximum productivity from their IT investments. MSSP2 Operates in nearly 30 countries and employs 47,000 personnel. They Help large private companies and public enterprises to take digital leadership, and is committed to creating value for customers and society with the mission of guiding their customers, partners and employees towards bold choices by leveraging digital technology to build a positive future for all. We selected these firms as they: (1) have an in-house, state of the art SOC and permanent 24/7 IR function
(both internal and as-a-service) that is mature and - amongst few, approved by an unnamed (sensitive) governing function, and (2) have evolved 'best practice' IR from experiences of highly sophisticated cyber-attacks.

<table><caption>**Table 1.** Subject selection</caption><thead><tr><td>Pseudonym</td><td>Role</td><td>Years in role</td></tr></thead><tbody><tr><td>CISO</td><td>Chief Information Security Officer</td><td>5 years</td></tr><tr><td>Manager_SOC</td><td>(SOC) Project Manager</td><td>0.3 years</td></tr><tr><td>Lead_IRT</td><td>Leader of Incident Response Team</td><td>7 years</td></tr><tr><td>TeamLead_SOC</td><td>Leader of analytics-team within SOC</td><td>2 years</td></tr><tr><td>L1Analyst_SOC</td><td>Tier 1 SOC analyst</td><td>1 year</td></tr><tr><td>Sec_Consult</td><td>Senior Security/Technical Consultant</td><td>1 year</td></tr><tr><td>Productollager</td><td>Manager of SOC services</td><td>15 years</td></tr><tr><td>Lead Onboarding</td><td>Director Onboarding</td><td>1 year</td></tr><tr><td>CSO</td><td>Chief Security Officer</td><td>8 years</td></tr><tr><td>Lead SOC</td><td>Professional Leader of SOC</td><td>3 years</td></tr></tbody></table>

Our selection criteria for selecting informants from these organizations was focused on the qualifications in terms of role in the company and professional background that allowed them to provide us with information and knowledge specific to our object of inquiry [33]. Different roles of relevance within the organizations were interviewed to provide richness and depth to our study. We made an inquiry to our contacts in *MSSP1* and *MSSP2* and shared our interest in interviewing; both junior and senior analysts working on their SIEM platform handling daily events, the CISO or other C-suite employees of relevance, a cyber-operations leader, a SOC leader, a cybersecurity strategy leader, and an employee working with cyber threat intelligence. This resulted in a total of 11 interviews, all of which provided valuable information to our research. We were determined from the beginning to ensure anonymity of our respondents and their employer, so that they could answer honestly without fear of repercussions. Table 1 displays the main characteristics of our respondents. Our sample size counts with a wide range of experience and areas of responsibility. To avoid "elite-bias", which can occur if one bases the selection only on top management such as directors, board chairmen, etc. we included a variety of subjects in the sample at various organizational levels [23].

We based our analysis on the content of the interviews which were transcribed and subsequently analyzed and coded in NVivo, a software to aid qualitative research. By coding the transcriptions we derived answers to common questions from the different participants into categorized themes, which were beneficial to us when comparing and presenting our findings. After reading and developing an understanding of how it could be categorized, we identified specific segments related to the questions to label and categorize confirming or contradicting answers. The interviews were broken down into five sections, each of which was labeled to contain questions on the same subject. The questions
vary from general questions about the candidate and their business in Part 1 to cybersecurity-related questions in Part 3 to a framework presentation in Part 5 where we wanted input on whether the framework accurately represented how incident management works in practice. Before presenting anything we had to translate the findings as the interviews were held in Norwegian, and we did it with utmost caution to prevent any translation-bias or misunderstandings. The findings section summarizes our main findings contrasted to existing theories from the literature review.

# 4 Summary of findings and discussion

We examined how MSSPs implement security operations to construct situational awareness. By looking into best practices within security operations centers (SOC) of large scale cybersecurity enterprises, we developed a generalized and holistic framework visualizing the function of an operational SOC. We examined elements to understand SA in cybersecurity incident management. In addition we identified conditional elements, functions and best practices involved to support SOCs in achieving their objectives.

Our proposed framework was then validated through interviews to eventually produce an empirically validated, final framework. In this section we present our empirical framework and discuss the findings from the validation to answer our research questions.

## 4.1 The conceptual framework

By drawing on related literature and through sense-making of the theoretical lens, we have developed a conceptual framework depicting how enterprise security operations work and are operationalized to reflect our understanding of how SA is constructed through the different organizational levels: operational, tactical and strategic. The following framework (Figure 1 below) uses the logic of [9]'s 'Situation Awareness' process model for human cognition and takes inspiration from [1]'s case study, combining their process model of Situation Awareness in Cybersecurity IR with their case unit "FinanceCentral's" information flow and communication pathways. The framework is modeled as a two-dimensional artifact. Cybersecurity stakeholders (L1 & L2, L3 and the SLT) are modeled across the vertical dimension representative to each of their organizational levels. The horizontal dimension models 'Situation Awareness' as of [9]'s process model for human cognition that is framed from an information-processing perspective. The "background colors" blue, green and yellow represent perception, comprehension and projection respectively through the different organizational levels. The framework features three kinds of dynamic behavior. The first is information processing behavior (data-driven vs goal-driven), the second is task behavior (escalation vs investigation) and the third is communication behavior (information flow and communication pathways) [1].
<figure><img src="image_3.png" /><figcaption>Figure 1. A conceptual framework of SA in SOC IR</figcaption></figure>

Information processing behavior is modeled using the blue arrows in Figure 1 that allow progression through the 3 states of SA knowledge. Based on [1]'s process model, the rightward pointing blue arrows reflect that organizations can acquire increasingly higher levels of SA from data-driven processes (moving from perception to comprehension to projection). The leftward pointing blue arrows reflect that goal-driven processing such as attention-focusing existing mental models can improve lower levels of SA (moving from projection to comprehension to perception).

## 4.2 InCReASE: A Dynamic Framework of Situational Awareness in Cybersecurity SOC-IR

As a result of comparing the conceptual framework (Figure 1) with our empirical inquiry, we have developed an empirically validated framework modelling how SOC-IR works and are operationalized to understand how SA is constructed
<figure><img src="image_4.png" /><figcaption>**Figure 2.** INCREASE: A dynamic framework enhancing situation Awareness in cyber incident response</figcaption></figure>
through the different organizational levels of 'best practice' MSSPs. The validated framework (Figure 2) is an outcome that uses the logic of [9]'s *Situation Awareness* process model for human cognition and, draws inspiration from [1]'s case study, the framework combines the process model of *Situation Awareness in Cybersecurity* IR with their case unit *"FinanceCentral"'s Information flow and communication pathways*. The framework was enhanced and validated by a process of sensemaking based on our interviews and discussions with ten cybersecurity specialists from two similar MSSPs providing cybersecurity services.

Our empirical analysis reveals that our theoretical findings were accurate before, during and after incident activities within security operations teams. Therefore, our interviews helped us to further expand some of the sections of the framework. For example, the use of SIEM platforms alongside a service desk. These two components feed raw data to L1 and L2 analysts in the SOC who collect and construct a picture of potential incidents and their criticality. Furthermore, we notice the employment of Cyber Threat Teams and Vendors that feed global IT operations data to the L3 analysts and leaders in the SOC. Here, a decision is made whether to escalate the incident to the strategic level where an incident management team with key strategic stakeholders is formed, lines of communications are established and an enterprise business perspective of the incident is constructed. In here, various scenarios of the incident (prediction) to inform decision making. Following the decision, an action plan outlining the recovery measurements is made for execution at the operational level. Both the inquired organizations incorporate 'lessons learned' in standard operating procedures after an incident occurs. The assessment of the situation and response after an incident is critical to determine the quality and effectiveness and optimal performance of the event. This quality assurance feature is something that our studied MSSPs highlighted as missing from our framework. We have denominated this aspect as 'Quality check' which results are brought in to the lessons learned for reflection.

We argue that in future events, operators undoubtedly could be informed about some aspect of a situation of which they were not aware of before - during the 'lessons learned' of which would increase their ability to construct situational awareness. Thus, as part of the feedback onto the environment is a reflection of the acquired SA from each perspective as illustrated in figure 2, representing the team's increased knowledge of the current operational picture. The next time an incident of similar nature occur, the reflected SA knowledge sees the entire team more resilient with better awareness of the environment resulting in improved cybersecurity readiness.

The framework within the organizational levels 'operational, tactical and strategic', is modeled as a two-dimensional artifact. Cybersecurity stakeholders are modeled across the vertical dimension representative to each of their levels as inspired by [1]'s case unit and 'Situation Awareness' as of [9]'s process model for human cognition is modeled across the horizontal dimension. Also based on [9]'s model is the *Situation awareness cycle* (black arrows) which can be recognized
from Figure 2. While some of the theory-informed dimensions of the framework
remain unchanged, the analysis identifies some changes and additions.

# 5 Conclusion

The goal of this exploratory study was first to develop an understanding of SA concepts and its role in cybersecurity; second is to investigate SA function in the context of enterprise MSSP cybersecurity operations; and third to examine how SA knowledge is constructed during incident response through the enterprise's organizational levels. To accomplish this—on a high level, we have provided an empirically validated framework, InCReASE, which models how MSSPs operationalized situational awareness in cybersecurity operations detection & response. The InCReASE framework models communication behavior and information flows between cybersecurity stakeholders, and conditional internal and external parties to coordinate the management of cybersecurity operations. Following the 'Situation awareness cycle' the MSSP projects the state of the environment through a socio-technical system which influences the SOC operations through its SIEM, CTI team and service desk. With emphasis on SA, the InCReASE framework shows how technology, people and processes either support or engage in the perception, comprehension and projection of the operational environment to construct SA knowledge across organizational levels to make informed decisions. The framework replicates how SA exists as a facilitator for decision-makers as the SA knowledge constructed in the different levels and those influencing the formulation of an action plan which initiates the execution of a decision through the incident response life cycle 'containment eradication & recovery'. Furthermore, the InCReASE framework accounts for the activities held post-incident to reflect upon the enterprise response, which we argue allows for the construction of team SA. Completing the SA cycle, the final stage 'feedback' imposes the course of action and impacts the state of the environment which is ultimately perceived by the MSSP through its *Situational Awareness* all over again.

Finally, given the nature of the organizations that were investigated in this
exploratory study, a key limitation is the lack of generalization. The inquired
organizations are large scale and ultimately specialized in cybersecurity services
(MSSPs), thus for smaller and less capable organizations the dynamics and ca-
pability requirements of the framework could be too complicated and could differ
substantially from that of e.g., an SME context. Thus, by expanding this work
to include a broader range of organizational contexts, as the fewest of organiza-
tions are of the size of LSE, one could improve the overall applicability of the
framework and significantly contribute to theory on the subject.
References

[1] Atif Ahmad et al. "How can organizations develop situation awareness for incident response: A case study of management practice." In: *Computers and Security* 101 (2021), p. 102122.

[2] Kenning Arlitsch and Adam Edelman. "Staying Safe: Cyber Security for People and Organizations." In: *Journal of Library Administration* 54.1 (2014), pp. 46-56.

[3] S. Bhatt, P.K. Manadhata, and L. Zomlot. "The operational role of security information and event management systems." In: *IEEE Security and Privacy* 12.5 (2014), pp. 35-41.

[4] Renaud Bidou, Julien Bourgeois, and Francois Spies. "Towards a Global Security Architecture for Intrusion Detection and Reaction Management." In: *Information Security Applications*. Ed. by Ki-Joon Chae and Moti Yung. Berlin, Heidelberg: Springer Berlin Heidelberg, 2004, pp. 111-123.

[5] M. Chopra and C. Mahapatra. "Significance of security information and event management (SIEM) in modern organizations." In: *International Journal of Innovative Technology and Exploring Engineering* 8.7 (2019), pp. 432-435.

[6] Mauro Conti, Ali Dehghantanha, and Tooska Dargahi. *Cyber threat intelligence*. Springer, 2018.

[7] John W. Cresswell. *The Selection of a Research Design the Three Types of Designs*. 2008.

[8] Martin Eileraas and Jarl Andreassen. "A Dynamic Framework Enhancing Situational Awareness in Cybersecurity SOC-IR." MA thesis. University of Agder, 2022.

[9] M.R. Endsley. "Toward a theory of situation awareness in dynamic systems." In: *Human Factors* 37.1 (1995), pp. 32-64.

[10] Antti Evesti, Teemu Kanstrén, and Tapio Frantti. "Cybersecurity situational awareness taxonomy." In: (2017), pp. 1-8.

[11] Ulrik Franke and Joel Brynielsson. "Cyber situational awareness – A systematic review of the literature." In: *Computers and Security* 46 (2014), pp. 18-31.

[12] Gartner. "Managed Security Service Provider (MSSP)." In: (2022).

[13] Gustavo González-Granadillo, Susana González-Zarzosa, and Rodrigo Diaz. "Security Information and Event Management (SIEM): Analysis, Trends, and Usage in Critical Infrastructures." In: *Sensors* 21.14 (2021).

[14] Cristin Goodwin et al. "A framework for cybersecurity information sharing and risk reduction." In: *Microsoft* (2015).

[15] Shaikha Hasan et al. "Evaluating the cyber security readiness of organizations and its influence on performance." In: *Journal of Information Security and Applications* 58 (2021), p. 102726.

[16] A. Horneman. *Situational Awareness for Cybersecurity: An Introduction*. Carnegie Mellon University's Software Engineering Institute Blog. Sept. 2019.
[17] Scott E. Jasper. "U.S. Cyber Threat Intelligence Sharing Frameworks." In: *International Journal of Intelligence and CounterIntelligence* 30 (2016).

[18] B. Kitchenham and S. Charters. "Guidelines for performing Systematic Literature Reviews in Software Engineering." In: (2007).

[19] Rafal Leszczyna and Michael Wrobel. "Threat intelligence platform for the energy sector." In: (2019).

[20] Mitre.org. "The Mitre Corporation." In: (2022). URL: https://www.mitre.org/.

[21] Joseph Muniz, Gary McIntyre, and Nadhem AlFardan. *Security Operations Center: Building, Operating, and Maintaining your SOC*. Cisco Press, 2015.

[22] M. D. Myers. "Qualitative Research in Information Systems." In: (2021).

[23] Michael D. Myers and Michael Newman. "The qualitative interview in IS research: Examining the craft." In: *Information and Organization* 17.1 (2007), pp. 2–26.

[24] Humza Naseer, Sean B. Maynard, and Kevin C. Desouza. "Demystifying analytical information processing capability: The case of cybersecurity incident response." In: *Decision Support Systems* 143 (2021), p. 113476.

[25] Megan Nyre-Yu, Robert Gutzwiller, and Barrett Caldwell. "Observing Cyber Security Incident Response: Qualitative Themes From Field Research." In: *Proceedings of the Human Factors and Ergonomics Society Annual Meeting* 63 (Nov. 2019), pp. 437–441.

[26] Kris Oosthoek and Christian Doerr. "Cyber Threat Intelligence: A Product Without a Process?" In: *International Journal of Intelligence and CounterIntelligence* 34.2 (2021), pp. 300–315.

[27] Prashanth Rajivan and Nancy Cooke. "Impact of Team Collaboration on Cybersecurity Situational Awareness." In: *Theory and Models for Cyber Situation Awareness*. Ed. by Peng Liu, Sushil Jajodia, and Cliff Wang. Cham: Springer International Publishing, 2017, pp. 203–226.

[28] F. Skopik, G. Settani, and R. Fiedler. "A Problem Shared is a Problem Halved." In: *Comput. Secur.* 60.C (2016).

[29] Steve Ursillo and Christopher Arnold. "Cybersecurity Is Critical for all Organizations – Large and Small." In: (2019).

[30] Verizon. *2021 Data Breach Investigations Report*. 2022. URL: https://www.verizon.com/business/resources/reports/2021/2021-data-breach-investigations-report.pdf.

[31] Manfred Vielberth et al. "Security Operations Center: A Systematic Study and Open Challenges." In: *IEEE Access* 8 (2020), pp. 227756–227779.

[32] Thomas D. Wagner et al. "Cyber threat intelligence sharing: Survey and research directions." In: *Computers and Security* 87 (2019), p. 101589.

[33] Robert K. Yin. *Case Study Research: Design and Methods*. 2014.