CASPIAN JOURNAL

MANAGEMENT AND HIGH TECHNOLOGIES

RESEARCH OF IRP SYSTEMS BASED ON THE ANALYSIS OF MECHANISMS OF RESPONSE TO INFORMATION SECURITY INCIDENTS

Read Ocheredko Andrey R., Bachmanov Dmitriy A., Putyato Michael M., Makaryan Alexander S. RESEARCH OF IRP SYSTEMS BASED ON THE ANALYSIS OF MECHANISMS OF RESPONSE TO INFORMATION SECURITY INCIDENTS // Caspian journal : management and high technologies. — 2021. — №1. — pp. 74-82.

Ocheredko Andrey R. - Kuban State Technological University, 2 Moskovskaya St., Krasnodar, 350072, Russian Federation

Bachmanov Dmitriy A. - Kuban State Technological University, 2 Moskovskaya St., Krasnodar, 350072, Russian Federation

Putyato Michael M. - Kuban State Technological University, 2 Moskovskaya St., Krasnodar, 350072, Russian Federation

Makaryan Alexander S. - Kuban State Technological University, 2 Moskovskaya St., Krasnodar, 350072, Russian Federation

The article discusses the features and functions of information security incident response systems. The analysis of modern IRP solutions is presented and the process of responding to typical incidents in systems of this class is described. Based on expert opinions, a list of criteria was formed, which were divided into groups by areas of functional responsibility for further comparison of the work of IRP systems. The assessment of the main and additional characteristics of IRP-systems was carried out using the formed criterion groups. The analysis of the comparison results showed that the most promising solutions are R-Vision IRP, IBM Resilient IRP and open-source solution - The Hive. The algorithm of the module for preventing phishing attacks was developed and presented, the software implementation of which was made using the Python language. As part of the integration capabilities of The Hive, a custom response function was implemented that not only potentially improved the system's performance in preventing phishing attacks, but also increased employee awareness of this threat. The result is an IRP system with personal flexible customization of individual elements and is the basis for the formation of the Security Center (SOC), which will bring the information security of organizations to a new level.

Key words: cybersecurity, IRP systems, information security incident, cyber attack, incident response mechanisms, phishing attacks