Security Operations Center: A Framework for Automated Triage, Containment and Escalation

There have been a lot of research exertions and studies to improve the safety of critical infrastructures using the Security Operations Center (SOC). As part of efforts, the purpose of this research is to propose a framework to automate the SOC’s performance of triage, containment and escalation. The research leveraged on qualitative desk review to collect data for analysis, deduced strengths and weaknesses for the current SOC implementations and used that as a basis for proposing the framework. In view of the constant evolution of SOC operations and capabilities coupled with the huge volumes of data collected for analysis, an efficient framework for SOC operations is proposed. The qualitative analysis is used to deduce strengths and weaknesses for the current SOC implementations as a premise for proposing the framework. It consists of eight interactive stages that further leverage on a proposed algorithm for baselining, remediation and escalation. The result of this research is a proposed framework that serves as a unique contribution to enhancing the SOC’s ability to automatically perform triage, containment and escalation. Supplementary to similar and earlier work reviewed, the framework is proposed as the way forward to automatically enable SOC setups with the capacity to efficiently perform triage of security threats, vulnerabilities and incidents, effectively contain identified breaches and appropriately escalate for prompt and accurate solutions.

Experience and practice of the Emergency Operations Centerz Chinese Center for Disease Control and Prevention:a case study of response to the H7N9 outbreak

Background:Emergency Operations Center(EOC)is a place to provide response to public health emergencies.Chinese Center for Disease Control and Prevention(China CDC)'s EOC was officially established in 2016,which has been the core department for the public health emergencies and risk response.In recent years,we have been continuously improving the function of EOC through many incidents.In the study,we hope to share the construction status,operation management experience of China CDC's EOC and the response process in the human avian influenza A(H7N9)outbreak.Main text:The China CDC's EOC mainly focus on building the five core elements including sites/places and facilities,information and data,plans and procedures,training and exercises,and logistics.Based on summarizing previous emergency respons巳the China CDC's EOC established its own incident management and the standardized response procedures.The event-specific data,context-specific data and event management data could be obtained through various source.The logistics department of the EOC also provides comprehensive support.The well-trained staff is another necessary conditions for its operation.Through sharing the response process of H7N9 outbreak,it further explains the EOC's functions in the five phases of outbreak response,such as the formulation of the incident response framework,monitoring,personnel dispatch and resource mobilization.Conclusions:The EOC con tributes to faster and more efficient responses during emergencies which en able a greater reduction in morbidity and mortality.Compared with the traditional incident response process,under the command and coordination of China CDC's EOC,each group involved in the response has a clearer goal,responsibilities and tasks at each stage.Meanwhile,each group also gave full play to its own expertise and advantages.As a whole,incident response tended to be more specialized and precise,which generally improves the efficiency of incident response.However,different countries and regions have different response processes to the events.We still suggested that appropriate emerge ncy operati on plan should be made according to the complexity of in cident response in the region when constructing response mechanism,through our experience.And the China CDC's EOC is still at growing and groping phase.

面向城市公共卫生数字治理的疾病预防控制应急作业中心管理平台建设

新型冠状病毒感染疫情发生以来,以传染病暴发为主的突发公共事件对超大城市的应急响应与治理能力提出了新的要求,应急作业中心的数字化转型成为各大城市选择的应对发展方向,而数字孪生技术与城市大数据的应用为我国应急作业中心的建设提供了新的思路。以上海市数智疾控应急作业中心管理平台建设为例,总结面向城市公共卫生数字治理平台建设的规划内容与设计经验,围绕系统架构、孪生架构、业务模型阐明平台的总体架构设计,详细介绍数字业务中心、应急指挥中心、辅助作业中心、孪生服务平台四大业务平台建设内容,为我国超大城市公共卫生数字治理提供新的发展思路与实证参考。

Leveraging the Public Health Emergency Operation Center (PHEOC)for pandemic response: opportunities and challenges

Public Health Emergency Operation Center (PHEOC) was conceptualized and established for coordinatinginformation and resources towards goal-oriented response in large scale public health emergency. Yet, theactivities undertaken by PHEOCs and their intended goals have not been fully optimized in current scenario.This paper revisited the collective efforts invested in PHEOC conceptualization and development, identified theopportunities and challenges in compliance with standards and framework, demonstrated the accountabilityof PHEOC network, thereby promoted best practice guidance for global public health emergency preparednessand response. This review will help navigate emergency response complexities leveraging PHEOC partnershipsand advance the ability to detect and respond to public health emergencies in low resource settings. The reviewshows that the information on how to adapt best practice guidance to local circumstances could incentivizethe full implementation of prevention, early detection and response to outbreaks. Identifying and correctingdeficiencies in effectiveness evaluation will provide the basis for continuous PHEOC improvement. With thegradually reopening economies and public services in some countries, there is an urgent need to emphasize andvalidate the collective efforts undertaken by PHEOCs for tackling the COVID-19 pandemic.

Smart City: On Urban Operational Collaboration

This paper expounds the origin of urban operational coordination problem in historical setting, points out that operational coordination problem is essential to cities, induces the major challenges and opportunities for urban operating coordination at present, and takes IBM Intelligent Operation Center as example to illustrate the typical solutions with the detailed case study of the Intelligent Operation Center in Rio de Janerio.

Smart Meter Deployment Threat and Vulnerability Analysis and Response

Advanced intelligent or ＂smart＂ meters are being deployed in Asia. A result of deployment of smart meters, with associated equipment, is the electric power industry faced with new and changing threats, vulnerabilities and re-evaluate traditional approaches to cyber security. Protection against emerging cyber-security threats targeting smart meter infrastructures will increase risk to both the utility and customer if not addressed within initial rollouts. This paper will discuss the issues in SMI （smart meter infrastructures） deployments that pertain to cyber security. It will cover topics such as the threats to operations, infrastructure, network and people and organization and their associated risks. SMI deployments include not only the smart meter, but also the interfaces for home energy management systems as well as communication interfaces back to the utility. Utilities must recognize and anticipate the new threat landscape that can attack and compromise the meter and the associated field network collectors. They must also include threats to the WAN （wide-area-network） backhaul networks, smart meter headends, MDMS （meter data management systems） and their interfaces to CIS （customer information systems） and billing and OMS （outage management systems）. Lessons learned from SMI implementations from North America, Europe and recently, Japan, will be discussed. How white-box and black-box testing techniques are applied to determine the threat impact to the SMI. Finally, organizational change risk will be discussed and how utilities have responded to re-organizing and developing a security governance structure for the SMI and other smart grid applications.

Binormal Operator and *-Aluthge Transformation

Let T = U｜T｜ be the polar decomposition of a bounded linear operator T on a Hilbert space. The transformation T = ｜T｜^1/2 U｜T｜^1/2 is called the Aluthge transformation and Tn means the n-th Aluthge transformation. Similarly, the transformation T（＊）=｜T＊｜^1/2 U｜T＊｜＆1/2 is called the ＊-Aluthge transformation and Tn^（＊） means the n-th ＊-Aluthge transformation. In this paper, firstly, we show that T（＊） = UV｜T^（＊）｜ is the polar decomposition of T（＊）, where ｜T｜^1/2 ｜T^＊｜^1/2 = V｜｜T｜^1/2 ｜T^＊｜^1/2｜ is the polar decomposition. Secondly, we show that T（＊） = U｜T^（＊）｜ if and only if T is binormal, i.e., [｜T｜, ｜T^＊｜]=0, where [A, B] = AB - BA for any operator A and B. Lastly, we show that Tn^（＊） is binormal for all non-negative integer n if and only if T is centered, and so on.