Security Incident Response Calculator Types

[SRIRAMSANKAR007]

Can someone explain how the calculators are working? And what are the types of calculators? When to use that respective type of calculator? 

My overview is like Calculators are mapped to a table and they will aggregate it for producing a respective score. But I am not clear in that.

[rahulswami · Accepted solution]

Hi @SRIRAMSANKAR007, 

Your understanding is close. Calculators do map to a table and aggregate conditions into a score, but there are four distinct types, each doing a different job.

1. Severity Calculators sit on the Security Incident table and check conditions such as critical asset involvement or multiple attack vectors, then update Risk score, Business Impact, or Priority when those conditions match.

They run automatically every time an incident is saved.

2. Risk Score Calculators also sit on the Security Incident table, but they specifically compute the numeric risk value, combining priority, incident category and indicator or observable data.

3. User Criticality Calculators sit on the User table instead. They set how critical a person is based on department or group membership and that value feeds into severity scoring.

4. Business Impact Calculator aggregates the output of the Severity Calculators into one final business impact score.

Sharing an example: say a security incident involves a phishing email sent to someone in Finance and the attack also used a spoofed domain. The User Criticality Calculator flags the affected user as high criticality because of the Finance department.

A Severity Calculator picks up the Multi-Attack Vector condition since email and impersonation are both involved and bumps Priority and Risk score.

The Risk Score Calculator then factors in the incident category, Phishing, along with the indicator reputation data, to produce a numeric risk score.

Finally, the Business Impact Calculator rolls all of that into one consolidated business impact rating for the incident.