| Listen on Mave | Listen on Yandex Music |
Ruslan Rakhmetov, Security Vision
Situational awareness is a model for assessing the environment. One of the most famous researchers in this field is Mika Endsley, where she formed the following definition: situational awareness is the perception of elements and events of the environment in relation to time or space, understanding their significance and projecting their status in the near future.
The purpose of situational awareness is to actively detect and analyse information relevant to immediate operational stability and safety, and to coordinate such information across the enterprise to ensure that all organisational units are operating within a common operating picture.
Situational awareness enables the organisation to understand the operational environment of critical services and the environment of impact on their performance. This understanding provides stakeholders with a reasonably accurate and relevant understanding of the past, current and projected future state of such services and supports effective decision making within the context of the overall operating environment.
The situational awareness process establishes a common operating picture by collecting, fusing, and analysing data to support automated or human decision-making in implementing cybersecurity incident response actions. Such data must necessarily be communicated in a timely manner and in a form that allows a human to quickly understand the key elements needed to make the right decisions.
The overall operational picture must be accurate and actionable (suitable for decision support and action). However, different participants in the enterprise need different and not necessarily complete knowledge of the operating environment. Depending on how it is presented, a complete picture may contain too much information and overwhelm the decision maker. Operators should also not be presented with a massive amount of data; rather, operators should only see what is important, as determined by the risk strategy and the overall risk picture.
Role and linkages of situational awareness
Situational awareness has a close and bidirectional relationship with all other processes in the cybersecurity division, such as asset management, vulnerability management, incident management, and risk management. Yes, situational awareness is also a process that must be integrated into the overall cybersecurity operations.
Asset management processes lay the foundation for situational awareness by identifying the critical services and related assets (with a link also to risk management) that the situational awareness process should focus on.
Risk management is the basis for identifying situational awareness requirements and the lens through which situational awareness information is interpreted and communicated. Risk management also involves several processes. Vendors, the vulnerability management team or other sources may report the existence of a vulnerability to the organisation. The situational awareness process provides this information to asset management, which determines which assets are vulnerable and the potential risks to critical services. This information is used for the situational awareness process, which passes it on to the risk management team. With this information, the risk management team can prioritise vulnerability risks over other risks and, if necessary, increase the urgency of corrective actions, such as requesting a patch or workaround from a vendor.
The situational awareness process feeds data to the incident management process, which can correlate it with information from other external CERTs and, if necessary, declare an incident and communicate it to the appropriate stakeholders.
The aligned situational awareness process has four steps through which the organisation plans, collects and analyses, shares information and improves the situational awareness process itself to improve operational efficiency and ensure the required level of cyber security for the organisation.
Figure 1 - Situational awareness process
1. Situational awareness planning
Planning is essential to the successful implementation of a situational awareness programme. The plan documents the objectives of the programme, the strategy to achieve those objectives, and the infrastructure and resources required to execute the plan. When planning for situational awareness, it is important to implement the following actions:
- Obtain management support in the form of resources
- Develop a strategy for the situational awareness programme
- Develop an approach to collecting and analysing situational awareness data
- Develop an approach to communicating situational awareness
- Develop a situational awareness plan.
2. Collect and analyse situational awareness data
Data collection and analysis is the main process that needs to:
- Establish the requirements for collecting and analysing situational awareness data
- Develop an approach to collecting and analysing situational awareness data
- Establish an infrastructure to support situational awareness monitoring activities
- Collect, record and analyse information.
3. information sharing
Information gathered through situational awareness activities must be effectively shared with stakeholders who need the information to make informed decisions about the cyber security of the organisation.
To build information sharing processes, it is necessary to:
- Establish requirements for situational awareness communication
- Establish standards and guidelines for information sharing
- Establish infrastructure to support situational awareness actions
- Communicate situational awareness.
4. Improve situational awareness processes and technologies
Successful risk management for critical services depends heavily on the effectiveness of the organisation's situational awareness processes and technologies. In an environment of increasing threats, it is particularly important for an organisation to continuously improve its situational awareness capabilities.
Situational awareness process and technology improvement activities include:
- Reviewing the overall effectiveness of the situational awareness programme
- Identifying updates and improvements to the situational awareness programme
- Making improvements to processes and technology.
Conclusion
Situational awareness involves the collection, analysis and communication of information that provides a broader and richer perspective of an organisation's operating environment. Situational awareness supports an ever-changing picture of the environment in which day-to-day operations take place. Being included in the overall process of evaluating economic, social, political and geographical factors, events that may not seem noteworthy in themselves may be identified as suspicious or even malicious. This context is required at the local or internal organisational level (organisational events such as redundancies, special high-profile events, etc.) as well as at the external, national or global level to observe, evaluate and correlate events and information.
