# Improving Incident Response in Big Data Ecosystems by Using Blockchain Technologies
## 4 Incident Response for Big Data Ecosystems
### Lessons Learned  
Finally, the last phase is about documenting the incident, writing down lessons learned; the objective is to obtain benefits from the incident. That is not the only goal, since at this point it is possible that new security requirements will be discovered that were not considered at first and that must be implemented in the system. If this scenario occurs, the analysis, design, and implementation phases defined previously must be performed again [9]. This phase is composed of two activities, summarized in Table 7.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Activities** & **Description** & **Inputs** & **Outputs** \\ \hline \multirow{3}{*}{Short term containment} & Limit the impact of the incident by carrying out effective and easy actions & Incident information blockchain systems & List of primary actions taken \\ \hline \multirow{3}{*}{System check} & Check the general state of the different assets affected by the incident & Incident information blockchain systems & Status of the big data ecosystem \\ \hline \multirow{3}{*}{Long term containment} & Implement definitive solutions that allow the continued use of the ecosystem & Incident information blockchain systems & \multirow{3}{*}{List of actions taken taken taken} \\ \hline \multirow{3}{*}{Recovery} & Check the normal execution of the ecosystem, with greater emphasis on the components affected & Incident information blockchain systems & Status of the big data ecosystem \\ \hline \multirow{3}{*}{Visualization of the status of the big data ecosystem} & Real-time monitoring of the operation of the components affected & Incident information Blockchain systems List of sources for indicators & \multirow{3}{*}{Status of the big data ecosystem} \\ \cline{1-1} \cline{3-3}  & & & \\ \hline \hline \end{tabular}
\end{table}
Table 6: Activities of Phase 4: Containment, eradication and recovery.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Activities** & **Description** & **Inputs** & **Outputs** \\ \hline \multirow{4}{*}{Write documentation} & Complete all the documentation about the incident in order to benefit from this in future incidents & Blockchain systems Incident information List of actions taken & \multirow{4}{*}{Lessons learned} \\ \cline{1-1} \cline{3-3}  & Use the lessons learned to keep improving the security of the ecosystem & Lessons learned & \multirow{4}{*}{New security requirements} \\ \cline{1-1} \cline{3-3}  & & & \\ \hline \hline \end{tabular}
\end{table}
Table 7: Activities of Phase 5: lessons learned.  
The first activity of this last phase consists of writing all the documentation that has not already been written up during the incident. This phase should not be taken lightly, since a good writing-up of the lessons learned can be very beneficial, helping to avoid the repetition of this type of incidents. Other new incidents could even be discovered, ones which may have taken advantage of a hole in the security of the system. When carrying out this activity it is advisable to hold a meeting between all the stakeholders who have been involved in one way or another during the incident. Furthermore, it is also desirable to use the incident data stored in the Blockchain systems to obtain a greater understanding of the incident itself.  
The second activity consists of using the lessons learned to try to improve the security of the system. In many cases, new security requirements may be identified that should be implemented in the system; to do that, it will be necessary to go back to the beginning of the cycle, as is shown in Figure 2.