DATA MODELS FOR INCIDENT RESPONSE AUTOMATIZATION

The purpose of the research is to develop priority data models: conceptual and logical, which allow responding to information security incidents in automated and fully automatic modes, primarily in terms of following action – information security incidents localization (containment). These response modes will allow organizations to reduce the time to detected information security incidents response measures implementation, i.e., they will timely complicate or completely stop of cyberattacks and minimize the damage caused by the attacker's actions. The research methods were analysis and synthesis of available materials and achievements, including patented ones, as well as modeling. According to the results, a conceptual data model is proposed, which, unlike the known ones, takes into account 3 options for the creation of information security incident (information security incident card), as well as independently considers logical and technical actions to information security incidents localization. A logical data model is proposed, which details the conceptual model and, unlike the known ones, takes into account that the selected response plan depends on the type and priority of the detected information security incident. The application of the results of this research has a positive effect in the field of technical sciences (methods and systems of information protection, information security). The area of application of the results is the centers of the State System of Detection, Prevention and Elimination of Consequences of Computer Attacks on Information Resources of the Russian Federation and Security Operations Center, as well as organizations-owners of large geographically distributed IT infrastructures with their own computer security incident response team. As a development of this research, the author is developing a physical data model and its testing.