The increasing challenge in cybersecurity has been often tied to the advancement in
technology development and its wide availability to end users. This development
resulted in increasing opportunities of cybersecurity attacks in order to achieve gains at
personal, organizational and national levels. The traditional approach to combat
cybersecurity threats has mostly relied on continuous investment in security technologies.
This approach has not effectively solved the problem as cybersecurity continue to
constitute an increasing challenge. In fact, research and industry reports now confirm that
technical controls alone are not sufficient to control cybersecurity threats [
However, one important capability we propose to bring to cyber range programs is
the ability to develop a holistic security mindset for security practitioners so they are
able to consider the socio-technical characteristics of cybersecurity incident response.
This poster proposes deploying two artefacts developed recently during the author PhD
research focusing on developing a socio-technical approach in cybersecurity incident
response [
This platform is designed to improve individual security awareness and learned lessons
from cybersecurity incidents. The platform consists of five different frames. Each frame
contains a different medium for presenting information: Hypervideo, Wiki, Frequently
Asked Questions (FAQ), PowerPoint Presentation and a Conversational Agent (Chat
bot). The knowledge provided from a cyber range program can be presented in these
different formats to take into consideration the different learning styles of cybersecurity
practitioners when developing their cybersecurity skills [
ST-SIEM is an artefact designed to improve the context of actionable security information before they are processed by security analysts within an organization. The objective is to improve the efficacy of handling security incidents within an organization. A general existing limitation in actionable security information they are not customized to consider the security culture of the organization supposed to act on these incidents. ST-SIEM handles this limitation by tailoring security information context to consider the organization security spending mental model – how an organization prioritize security spending on different security controls: deter, detect, prevent, correct and recover. Moreover, ST-SIEM adapts the risk factor of security information based on the organization risk escalation maturity level measured and registered in the system. Finally, ST-SIEM associate social taxonomies with impact factor based on the business background (risks and priorities) of the organization. ST-SIEM was developed as a prototype and integrated with an open source SIEM tool. Figure 2 depicts the architecture of ST-SIEM including the socio-technical correlation engine which correlates the technical attributes of the security incident with the social attributes created based on the modeling of each organization security culture. Figure 3 depicts the defined roles to operate ST-SIEM artifact including the interaction between these different roles.