I come from an engineering background where we use tools like 5-times-why or 8D for Root Cause Analysis.

Are there similar frameworks to perform an analysis on a reported a security incident?


5 Whys works great on security incidents.

There are also more formal frameworks like STIX (https://oasis-open.github.io/cti-documentation/stix/intro) and various "kill chain" models (see https://Unifiedkillchain.com).

Both STIX and kill chain prompt with specific questions such as who did what and how, or more specifically, they give you ways to record that information, prompting you to ask.

The key difference is STIX/kill chain will give you what happened, but not the how it was allowed to happen, which you get from 5 whys.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.