# Improving Incident Response in Big Data Ecosystems by Using Blockchain Technologies
## 1 Introduction  
Big data is here. It has ceased to be hype and has become a reality in medium and large companies of any sector. These organizations use the analytical capabilities of big data ecosystems to obtain valuable information to carry out their daily activities and to help in the decision making of top management [1]. A Big data ecosystem is usually defined as a set of different components that allow the storage, processing, preparation, visualization and delivery of useful information to target applications or end-users. Normally, these components are very complex, and need to work together if valuable insights are to be obtained [2]. These components can range from relational and non-relational databases to machine learning algorithms, virtual machines or containers, or even the underlying hardware that supports their services [3]. The use of new technologies brings fresh opportunities and perspectives; however, these new technologies can create new problems; big data ecosystems are no exception. These issues are relatednot only to the three typical V's of big data (volume of data, velocity of the rate of data processing and variety of data types and sources), but also to security. Big data not only increases the size of the problems related to security and privacy, as faced in the traditional management of security; it also has new vulnerabilities and threats to face. This problematic situation should be addressed by using different techniques and mechanisms [4]; for example, considering how to increase the privacy of the data used by big data through the use of anonymization techniques [5]. Moreover, these security issues are intensified by the fact that big data was not initially conceived of as a secure environment [6]; the main security problems are thus related to the specific architecture of big data, which makes it more difficult to ensure the privacy of the data that is being used [7]. When carrying out a big data project, it is important to consider the inherent characteristics of this kind of ecosystem, and how it is different than a traditional software development. As stated before, big data ecosystems are usually very complex systems where different technologies work together to reach a goal. Moreover, this kind of systems is usually deployed in companies where a short time-to-market and the need to adapt to change is essential. In addition, many of those companies are immersed in an internal cultural evolution, endeavoring to be more agile and innovative; this is the case in the DevOps movement [8]. As a consequence of this pressure, along with the misunderstanding and misuse of agile methodologies, the development of big data ecosystems is usually chaotic, not giving enough consideration to the importance of the requirements and risks of the system. For that reason, we have proposed a process whose purpose is to implement secure big data ecosystems [9] based on the concept of security-by-design. This process focuses mainly on the phases of analysis, design and implementation of the big data; but what happens once the ecosystem is already deployed and working? In any kind of IT system, when a security incident occurs, it is crucial to have an early response mechanism that guarantees the continuity of the system. To achieve this objective, it is important to have accurate and reliable information on those operations carried out that may have influenced the incident, so that the response to these incidents is adequate [10]. In a complex environment with a large number of nodes interacting with each other, where multiple users are accessing and generating new data, it is important to have a system that can store forensic evidence on the operations performed in the big data. A monitoring mechanism that captures some subsets of these interactions and uses them to generate interesting insights can often lead to a greater understanding of a system's behavior [11].