Towards Unified European Cyber Incident and Crisis Management Ontology

Keywords:

Abstract:

ENISA highlighted the need for a common reporting taxonomy for cybersecurity incidents to be used by cybersecurity analysts across Europe. The analysis of the domain revealed a large number of taxonomies for different areas of the cybersecurity domain (types of attacks, vulnerabilities, sectors, harm), but those needed to be linked together in a model that allows a cybersecurity officer to report and track an incident fast and accurately. The taxonomy should also treat the cybersecurity domain not only from the technical point of view but also from the socio-economical aspect. This document describes the taxonomy, how we propose to use it, and the methodology used to develop it.