title: ÐÐ¾ÑÑÑÐ¾ÐµÐ½Ð¸Ðµ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ½ÑÑÐ° Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÑ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð½Ð° Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ð¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¼Ð°Ð³Ð¸ÑÑÑÐ°
titleType: Subtitle
title: Building an effective center for rapid response to information security incidents at the enterprise
Creators: name: ÐÐµÑÑÐµÑÐ¾Ð², ÐÐ»ÐµÐºÑÐ°Ð½Ð´Ñ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2020
Subjects: ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ
ÑÐ¸ÑÑÐ¾Ð²Ð¾Ð¹ Ð±Ð¸Ð·Ð½ÐµÑ
ÑÐµÐ½ÑÑ Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÑ
ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ðµ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑÑ ÐºÐ¾Ð¼Ð¿Ð°Ð½Ð¸Ð¸
digital business
center for rapid response to incidents
company security management

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ½ÑÑÐ° Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÑ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð½Ð° Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ð¸. ÐÐ°Ð´Ð°ÑÐ¸, ÐºÐ¾ÑÐ¾ÑÑÐµ ÑÐµÑÐ°Ð»Ð¸ÑÑ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÐ·ÑÑÐµÐ½Ð¸Ðµ ÐºÐ¾Ð¼Ð¿Ð°Ð½Ð¸Ð¸, Ð¾ÑÐµÐ½ÐºÐ° ÑÐ°Ð±Ð¾ÑÑ ÐµÐµ ÑÐ»ÑÐ¶Ð±Ñ ÐºÐ¾ÑÐ¿Ð¾ÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð¹ Ð·Ð°ÑÐ¸ÑÑ Ð¸ Ð¾Ð±Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼. 2. Ð¤Ð¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÐµÐ¾ÑÐµÑÐ¸ÑÐµÑÐºÐ¸Ñ Ð°ÑÐ¿ÐµÐºÑÐ¾Ð² Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ½ÑÑÐ° Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÑ. 3. Ð¤Ð¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÐµÐ±Ð¾Ð²Ð°Ð½Ð¸Ð¹ Ðº ÑÐ¸ÑÑÐµÐ¼Ðµ ÑÐ±Ð¾ÑÐ° Ð¸ Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÐ¸ ÑÐ¾Ð±ÑÑÐ¸Ð¹. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿ÑÐ¾ÐµÐºÑÐ° ÑÐ¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ñ ÑÐµÐ½ÑÑÐ° Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÑ. 5. ÐÑÐ±Ð¾Ñ Ð½ÐµÐ¾Ð±ÑÐ¾Ð´Ð¸Ð¼ÑÑ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ð¸ Ð¸Ð½ÑÑÑÑÐ¼ÐµÐ½ÑÐ¾Ð². 6. ÐÑÐµÐ½ÐºÐ° Ð·Ð°ÑÑÐ°Ñ Ð½Ð° Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ñ. 7. Ð¡ÑÐ°Ð²Ð½ÐµÐ½Ð¸Ðµ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÑ Ð¼ÐµÑÑÐ¸Ðº Ð´Ð¾ Ð¸ Ð¿Ð¾ÑÐ»Ðµ Ð²Ð½ÐµÐ´ÑÐµÐ½Ð¸Ñ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ñ. Ð Ð°Ð±Ð¾ÑÐ° Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð° Ð½Ð° Ð±Ð°Ð·Ðµ ÐºÐ¾Ð¼Ð¿Ð°Ð½Ð¸Ð¸ ÐÐÐ Â«IT Arch GroupÂ», Ð½Ð°ÑÑÐ¾ÑÑÐµÐµ Ð½Ð°Ð·Ð²Ð°Ð½Ð¸Ðµ ÐºÐ¾ÑÐ¾ÑÐ¾Ð¹ Ð¿ÑÐ¸Ð²ÐµÑÑÐ¸ Ð½Ðµ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÑÐµÑÑÑ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½ÑÐ¼ Ð¸Ð·-Ð·Ð° ÑÐ³ÑÐ¾Ð·Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð³Ð´Ðµ ÑÐ¾Ð±Ð¸ÑÐ°Ð»Ð°ÑÑ Ð·Ð½Ð°ÑÐ¸ÑÐµÐ»ÑÐ½Ð°Ñ ÑÐ°ÑÑÑ ÑÐ°ÐºÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð¼Ð°ÑÐµÑÐ¸Ð°Ð»Ð°: Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÑÑÑÐºÑÑÑÐ°, Ð¾ÑÐ½Ð¾Ð²Ð½ÑÐµ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÐµ Ð°ÐºÑÐ¸Ð²Ñ, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÐµ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÐµ ÑÐ¸ÑÑÐµÐ¼Ñ, Ð¼ÐµÑÑÐ¸ÐºÐ¸ ÑÐ°Ð±Ð¾ÑÑ ÑÐ»ÑÐ¶Ð±Ñ ÐºÐ¾ÑÐ¿Ð¾ÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð¹ Ð·Ð°ÑÐ¸ÑÑ. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð±ÑÐ»Ð° Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð° Ð¸ Ð¾ÑÐµÐ½ÐµÐ½Ð° ÑÐ°Ð±Ð¾ÑÑ ÑÐ»ÑÐ¶Ð±Ñ ÐºÐ¾ÑÐ¿Ð¾ÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð¹ Ð·Ð°ÑÐ¸ÑÑ, Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ñ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÐµ ÐµÐµ Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼Ñ. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¸ Ð²Ð½ÐµÐ´ÑÐµÐ½ Ð¿ÑÐ¾ÐµÐºÑ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ñ ÑÐµÐ½ÑÑÐ° Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÑ. Ð¡Ð¿ÑÑÑÑ Ð½ÐµÐºÐ¾ÑÐ¾ÑÐ¾Ðµ Ð²ÑÐµÐ¼Ñ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð° Ð¾ÑÐµÐ½ÐºÐ° ÐµÐ³Ð¾ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸. ÐÐ° Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð¸Ð¸ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð½ÑÑ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ¾Ð², Ð² ÐÐÐ Â«IT Arch GroupÂ» Ð±ÑÐ»Ð¾ Ð¿ÑÐ¸Ð½ÑÑÐ¾ ÑÐµÑÐµÐ½Ð¸Ðµ Ð¾Ð± ÑÑÐ¿ÐµÑÐ½Ð¾ÑÑÐ¸ Ð²Ð½ÐµÐ´ÑÐµÐ½Ð¸Ñ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ñ.
description: This work is devoted to the study of building an effective center for rapid response to information security incidents at an enterprise. The research set the following goals: 1. Studying the company, evaluating the work of its corporate security service and justifying the problems. 2. Formation of theoretical aspects of building an effective center for rapid response to incidents. 3. Formation of requirements for the system for collecting and processing events. 4. Development of a project to form a subdivision of an incident response center. 5. Selection of the necessary information systems and tools. 6. Estimation of expenses for the organization of the organization unit. 7. Comparison of the main metrics before and after the implementation of the organization unit. The work was fulfilled on the premises of IT Arch Group LLC, the real name of which is not possible to give due to the security threat, which included collection of factual materials, i. e. organizational structure, main information assets, information systems used, metrics of the corporate security service. As a result, the work of the corporate security service was analyzed and evaluated, its main problems were identified. A project for a subdivision of an incident response center was developed and implemented. After some time, its effectiveness was assessed. Based on the results obtained, IT Arch Group LLC made a decision on the success of the organization unit implementation.