{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T05:05:23Z","timestamp":1750309523055,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":60,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,9,16]],"date-time":"2024-09-16T00:00:00Z","timestamp":1726444800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"EPSRC Centre for Doctoral Training for Cyber Security (TIPS at Scale)"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,9,16]]},"DOI":"10.1145\/3703465.3703471","type":"proceedings-article","created":{"date-parts":[[2025,1,16]],"date-time":"2025-01-16T12:18:31Z","timestamp":1737029911000},"page":"71-83","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Adopting a Systemic Design Approach to Cyber Security Incident Response"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-8350-4438","authenticated-orcid":false,"given":"Emma","family":"Woodward","sequence":"first","affiliation":[{"name":"University of Bath, Bath, United Kingdom"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6706-9745","authenticated-orcid":false,"given":"Barnaby","family":"Craggs","sequence":"additional","affiliation":[{"name":"University of Bristol, Bristol, United Kingdom"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3062-731X","authenticated-orcid":false,"given":"Dana\u00eb Stanton","family":"Fraser","sequence":"additional","affiliation":[{"name":"University of Bath, Bath, United Kingdom"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7019-7038","authenticated-orcid":false,"given":"Adam","family":"Joinson","sequence":"additional","affiliation":[{"name":"University of Bath, Bath, United Kingdom"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,1,16]]},"reference":[{"key":"e_1_3_3_1_2_2","doi-asserted-by":"crossref","unstructured":"Enoch Agyepong Yulia Cherdantseva Philipp Reinecke and Pete Burnap. 2023. A systematic method for measuring the performance of a cyber security operations centre analyst. Computers & Security 124 (2023) 102959.","DOI":"10.1016\/j.cose.2022.102959"},{"key":"e_1_3_3_1_3_2","unstructured":"Qutaiba Albluwi. 2017. Framework for Performance Evaluation of Computer Security Incident Response Capabilities. Ph.\u00a0D. Dissertation. University of Rhode Island."},{"key":"e_1_3_3_1_4_2","doi-asserted-by":"crossref","unstructured":"Bilal AlSabbagh and Stewart Kowalski. 2017. Socio-Technical SIEM (ST-SIEM): Towards Bridging the Gap in Security Incident Response. International Journal of Systems and Society (IJSS) 4 2 (2017) 8\u201321.","DOI":"10.4018\/IJSS.2017070102"},{"key":"e_1_3_3_1_5_2","volume-title":"Systems thinking basics","author":"Anderson Virginia. Lauren\u00a0Johnson","year":"1997","unstructured":"Virginia. Lauren\u00a0Johnson Anderson. 1997. Systems thinking basics. Pegasus Communications, Cambridge, MA."},{"key":"e_1_3_3_1_6_2","unstructured":"Systemic\u00a0Design Association. 2023. Kingston Live October 8th: Cyber I& Digital. https:\/\/rsdsymposium.org\/systemic-design-hub-cyber\/ Accessed on July 10 2024."},{"key":"e_1_3_3_1_7_2","unstructured":"Systemic\u00a0Design Association. 2023. Systemic Design. https:\/\/systemic-design.org\/#:\u00a0:text=Systemic%20design%20has%20moved%20toward are%20building%20a%20common%20understanding. Accessed on July 10 2024."},{"key":"e_1_3_3_1_8_2","unstructured":"Maria Bada Sadie Creese Michael Goldsmith Chris Mitchell and Elizabeth Phillips. 2017. Improving the effectiveness of CSIRTs. Global Cyber Security Capacity Centre (2017)."},{"key":"e_1_3_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-2045-2_2"},{"key":"e_1_3_3_1_10_2","doi-asserted-by":"crossref","unstructured":"Mieke van\u00a0der Bijl-Brouwer and Bridget Malcolm. 2020. Systemic Design Principles in Social Innovation: A Study of Expert Practices and Design Rationales. She Ji 6 3 (2020) 386\u2013407. https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2405872620300447 Accessed on July 10 2024.","DOI":"10.1016\/j.sheji.2020.06.001"},{"key":"e_1_3_3_1_11_2","doi-asserted-by":"crossref","unstructured":"Tiffani\u00a0R Chen Daniel\u00a0B Shore Stephen\u00a0J Zaccaro Reeshad\u00a0S Dalal Lois\u00a0E Tetrick and Aiva\u00a0K Gorab. 2014. An organizational psychology perspective to examining computer security incident response teams. IEEE Security & Privacy 12 5 (2014) 61\u201367.","DOI":"10.1109\/MSP.2014.85"},{"key":"e_1_3_3_1_12_2","unstructured":"Andrea Fox. 2022. Concern for cybersecurity workforce mental health is rising. Healthcare IT news (02.11.2022 2022). https:\/\/www.healthcareitnews.com\/news\/concern-cybersecurity-workforce-mental-health-rising Accessed on July 10 2024."},{"key":"e_1_3_3_1_13_2","unstructured":"UK Government. 2023. UK Innovation Strategy: leading the future by creating it. https:\/\/www.gov.uk\/government\/publications\/uk-innovation-strategy-leading-the-future-by-creating-it\/uk-innovation-strategy-leading-the-future-by-creating-it-accessible-webpage Accessed on July 10 2024."},{"key":"e_1_3_3_1_14_2","doi-asserted-by":"publisher","unstructured":"Douglas Harper. 2002. Talking about pictures: A case for photo elicitation. Visual Studies 17 1 (2002) 13\u201326. 10.1080\/14725860220137345","DOI":"10.1080\/14725860220137345"},{"key":"e_1_3_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-39512-4_90"},{"key":"e_1_3_3_1_16_2","doi-asserted-by":"crossref","unstructured":"Sohail Inayatullah. 1998. Causal layered analysis: Poststructuralism as method. Futures 30 8 (1998) 815\u2013829.","DOI":"10.1016\/S0016-3287(98)00086-X"},{"key":"e_1_3_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSecPODS.2019.8885240"},{"key":"e_1_3_3_1_18_2","volume-title":"Proceedings of the 58th annual meeting of the ISSS-2014 United States","author":"Jones Peter","year":"2014","unstructured":"Peter Jones. 2014. Design research methods for systemic design: Perspectives from design education and practice. In Proceedings of the 58th annual meeting of the ISSS-2014 United States."},{"key":"e_1_3_3_1_19_2","volume-title":"Design Journeys through Complex Systems - Practice Tools for Systemic Design","author":"Jones Peter","year":"2022","unstructured":"Peter Jones and Kristel\u00a0Van Ael. 2022. Design Journeys through Complex Systems - Practice Tools for Systemic Design. BIS Publishers."},{"key":"e_1_3_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISPA.2008.33"},{"key":"e_1_3_3_1_21_2","first-page":"963","volume-title":"35th International Conference of the System Dynamics Society","author":"Landry Erik","year":"2017","unstructured":"Erik Landry and John Sterman. 2017. The capability trap: prevalence in human systems. In 35th International Conference of the System Dynamics Society. 963\u20131010."},{"key":"e_1_3_3_1_22_2","unstructured":"Donella Meadows. 1999. Leverage Points - Places to Intervene in a System. Sustainability Institute 19 (1999) 28. https:\/\/mchwdc.unc.edu\/wp-content\/uploads\/2022\/04\/Leverage-Points_Places-to-Intervene-in-a-System-Meadows.pdf Accessed on July 10 2024."},{"key":"e_1_3_3_1_23_2","doi-asserted-by":"crossref","unstructured":"Donella Meadows. 2001. Dancing with systems. Whole Earth 106 3 (2001) 58\u201363.","DOI":"10.1016\/S0164-1212(01)00100-5"},{"key":"e_1_3_3_1_24_2","unstructured":"Jenny. Moffett. 2022. Five tips for using design thinking to transform your academic practice. https:\/\/www.timeshighereducation.com\/campus\/five-tips-using-design-thinking-transform-your-academic-practice Accessed on July 10 2024."},{"key":"e_1_3_3_1_25_2","unstructured":"Rajat Mohanty. 2018. How Design Thinking Can Change Cybersecurity. https:\/\/www.forbes.com\/sites\/forbestechcouncil\/2018\/05\/22\/how-design-thinking-can-change-cybersecurity\/ Accessed on July 10 2024."},{"key":"e_1_3_3_1_26_2","unstructured":"Newsweek. 1994. A Swat Team In Cyberspace. https:\/\/www.newsweek.com\/swat-team-cyberspace-190114 Accessed on July 10 2024."},{"key":"e_1_3_3_1_27_2","doi-asserted-by":"crossref","unstructured":"Megan Nyre-Yu. 2021. Identifying expertise gaps in cyber incident response: Cyber defender needs vs. Technological Development. 54th Hawaii International Conference on System Sciences (2021).","DOI":"10.24251\/HICSS.2021.242"},{"key":"e_1_3_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1177\/1071181319631016"},{"key":"e_1_3_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22351-9_22"},{"key":"e_1_3_3_1_30_2","unstructured":"Megan\u00a0M Nyre-Yu. 2019. Determining system requirements for human-machine integration in cyber security incident response. Ph.\u00a0D. Dissertation. Purdue University."},{"key":"e_1_3_3_1_31_2","unstructured":"Hasso Platner. unknown. An Introduction to Design Thinking: PROCESS GUIDE. https:\/\/web.stanford.edu\/\u00a0mshanks\/MichaelShanks\/files\/509554.pdf Accessed on July 10 2024."},{"key":"e_1_3_3_1_32_2","doi-asserted-by":"crossref","unstructured":"Horst\u00a0WJ Rittel and Melvin\u00a0M Webber. 1973. Dilemmas in a general theory of planning. Policy sciences 4 2 (1973) 155\u2013169.","DOI":"10.1007\/BF01405730"},{"key":"e_1_3_3_1_33_2","doi-asserted-by":"publisher","unstructured":"Robin Ruefle Audrey Dorofee David Mundie Allen\u00a0D. Householder Michael Murray and Samuel\u00a0J. Perl. 2014. Computer Security Incident Response Team Development and Evolution. IEEE Security I& Privacy 12 5 (2014) 16\u201326. 10.1109\/msp.2014.89","DOI":"10.1109\/msp.2014.89"},{"key":"e_1_3_3_1_34_2","doi-asserted-by":"crossref","unstructured":"Alex Ryan. 2014. A framework for systemic design. FORMakademisk 7 4 (2014).","DOI":"10.7577\/formakademisk.787"},{"key":"e_1_3_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-7643-8472-2_12"},{"key":"e_1_3_3_1_36_2","unstructured":"Bruce Schneier. 2014. Keynote Talk: The State of Incident Response. https:\/\/www.youtube.com\/watch?v=u54Radu2bF0 Accessed on July 10 2024."},{"key":"e_1_3_3_1_37_2","volume-title":"Design Research Society","author":"Sevaldson Birger","year":"2013","unstructured":"Birger Sevaldson. 2013. Systems Oriented Design: The emergence and development of a designerly approach to address complexity. In Design Research Society. https:\/\/dl.designresearchsociety.org\/learnxdesign\/learnxdesign2013\/researchpapers\/131\/"},{"key":"e_1_3_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-4-431-55639-8_8"},{"key":"e_1_3_3_1_39_2","doi-asserted-by":"crossref","unstructured":"Birger Sevaldson and Peter Jones. 2019. An Interdiscipline Emerges: Pathways to Systemic Design. She Ji: The Journal of Design Economics and Innovation 5 2 (2019) 75\u201384. https:\/\/www.sciencedirect.com\/journal\/she-ji-the-journal-of-design-economics-and-innovation\/vol\/5\/issue\/2 Accessed on July 10 2024.","DOI":"10.1016\/j.sheji.2019.05.002"},{"key":"e_1_3_3_1_40_2","unstructured":"Piya Shedden Atif Ahmad and AB Ruighaver. 2010. Organisational learning and incident response: promoting effective learning through the incident response process. Australian Information Security Management Conference (2010)."},{"key":"e_1_3_3_1_41_2","unstructured":"Benjamin Shreeve Joseph Gardiner Joseph Hallett David Humphries and Awais Rashid. 2023. Decisions & Disruptions 2: Decide Harder. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2306.12168 (2023)."},{"key":"e_1_3_3_1_42_2","doi-asserted-by":"crossref","unstructured":"Rebecca Slayton and Brian Clarke. 2020. Trusting infrastructure: The emergence of computer security incident response 1989\u20132005. Technology and Culture 61 1 (2020) 173\u2013206.","DOI":"10.1353\/tech.2020.0036"},{"key":"e_1_3_3_1_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/3584318.3584322"},{"key":"e_1_3_3_1_44_2","doi-asserted-by":"crossref","unstructured":"Marc Steen. 2013. Co-design as a process of joint inquiry and imagination. Design issues 29 2 (2013) 16\u201328.","DOI":"10.1162\/DESI_a_00207"},{"key":"e_1_3_3_1_45_2","doi-asserted-by":"crossref","unstructured":"Julie Steinke Balca Bolunmez Laura Fletcher Vicki Wang Alan\u00a0J Tomassetti Kristin\u00a0M Repchick Stephen\u00a0J Zaccaro Reeshad\u00a0S Dalal and Lois\u00a0E Tetrick. 2015. Improving cybersecurity incident response team effectiveness using teams-based research. IEEE Security & Privacy 13 4 (2015) 20\u201329.","DOI":"10.1109\/MSP.2015.71"},{"key":"e_1_3_3_1_46_2","volume-title":"SIM3 : Security Incident Management Maturity Model","author":"Stikvoort Don","year":"2015","unstructured":"Don Stikvoort. 2015. SIM3 : Security Incident Management Maturity Model. Report. The G\u00c9ANT Association. https:\/\/www.trusted-introducer.org\/SIM3-Reference-Model.pdf Accessed on July 10, 2024."},{"key":"e_1_3_3_1_47_2","volume-title":"SIM3 : Security Incident Management Maturity Model","author":"Stikvoort Don","year":"2019","unstructured":"Don Stikvoort. 2019. SIM3 : Security Incident Management Maturity Model. Report. The G\u00c9ANT Association. https:\/\/opencsirt.org\/wp-content\/uploads\/2019\/12\/SIM3-mkXVIIIc.pdf Accessed on July 10, 2024."},{"key":"e_1_3_3_1_48_2","first-page":"347","volume-title":"Eleventh symposium on usable privacy and security (SOUPS 2015)","author":"Sundaramurthy Sathya\u00a0Chandran","year":"2015","unstructured":"Sathya\u00a0Chandran Sundaramurthy, Alexandru\u00a0G Bardas, Jacob Case, Xinming Ou, Michael Wesch, John McHugh, and S\u00a0Raj Rajagopalan. 2015. A human capital model for mitigating security analyst burnout. In Eleventh symposium on usable privacy and security (SOUPS 2015). 347\u2013359."},{"key":"e_1_3_3_1_49_2","doi-asserted-by":"crossref","unstructured":"Sathya\u00a0Chandran Sundaramurthy John McHugh Xinming\u00a0Simon Ou S\u00a0Raj Rajagopalan and Michael Wesch. 2014. An anthropological approach to studying CSIRTs. IEEE Security & Privacy 12 5 (2014) 52\u201360.","DOI":"10.1109\/MSP.2014.84"},{"key":"e_1_3_3_1_50_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-62217-0_33"},{"key":"e_1_3_3_1_51_2","unstructured":"Systemic\u00a0Design Toolkit. 2021. Systemic Design Toolkit. https:\/\/www.systemicdesigntoolkit.org\/download Accessed on July 18 2024."},{"key":"e_1_3_3_1_52_2","doi-asserted-by":"crossref","unstructured":"Rick Van\u00a0der Kleij Geert Kleinhuis and Heather Young. 2017. Computer security incident response team effectiveness: A needs assessment. Frontiers in psychology 8 (2017) 2179.","DOI":"10.3389\/fpsyg.2017.02179"},{"key":"e_1_3_3_1_53_2","volume-title":"Incident response (1st ed.)","author":"Van\u00a0Wyk Kenneth\u00a0R","year":"2001","unstructured":"Kenneth\u00a0R Van\u00a0Wyk and Richard Forno. 2001. Incident response (1st ed.). O\u2019Reilly, Sebastopol, CA."},{"volume-title":"Global Incident Response Threat Report","year":"2022","key":"e_1_3_3_1_54_2","unstructured":"vmware. 2022. Global Incident Response Threat Report. Report. VMware. https:\/\/www.vmware.com\/content\/dam\/learn\/en\/amer\/fy23\/pdf\/1553238_Global_Incident_Response_Threat_Report_Weathering_The_Storm.pdf Accessed on July 10, 2024."},{"key":"e_1_3_3_1_55_2","doi-asserted-by":"crossref","unstructured":"Steve Waddell. 2016. Societal change systems: a framework to address wicked problems. The Journal of Applied Behavioral Science 52 4 (2016) 422\u2013449.","DOI":"10.1177\/0021886316666374"},{"key":"e_1_3_3_1_56_2","unstructured":"Carol\u00a0H. Weiss. 1995. Nothing as practical as good theory: Exploring theory-based evaluation for comprehensive community initiatives for children and families. New approaches to evaluating community initiatives Concepts methods and contexts 1 (1995) 65\u201392."},{"key":"e_1_3_3_1_57_2","doi-asserted-by":"crossref","unstructured":"MJ West-Brown Don Stikvoort Klaus-Peter Kossakowski Georgia Killcrece Robin Ruefle and Mark Zajicek. 2003. Handbook for computer security incident response teams (csirts). Online document (2003).","DOI":"10.21236\/ADA413778"},{"key":"e_1_3_3_1_58_2","volume-title":"Twenty Seventh International Conference of the System Dynamics Society July, at Albuquerque, NM, USA","author":"Wiik Johannes","year":"2009","unstructured":"Johannes Wiik, Jose\u00a0J Gonzalez, P\u00e5l\u00a0I Davidsen, and Klaus-Peter Kossakowski. 2009. Chronic workload problems in CSIRTs. In Twenty Seventh International Conference of the System Dynamics Society July, at Albuquerque, NM, USA. Citeseer."},{"key":"e_1_3_3_1_59_2","volume-title":"17th Annual FIRST Conference on Computer Security Incident Handling. Singapore","author":"Wiik Johannes","year":"2005","unstructured":"Johannes Wiik and Klaus-Peter Kossakowski. 2005. Dynamics of incident response. In 17th Annual FIRST Conference on Computer Security Incident Handling. Singapore."},{"key":"e_1_3_3_1_60_2","first-page":"2259","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Woods Daniel\u00a0W","year":"2023","unstructured":"Daniel\u00a0W Woods, Rainer B\u00f6hme, Josephine Wolff, and Daniel Schwarcz. 2023. Lessons lost: Incident response in the age of cyber insurance and breach attorneys. In 32nd USENIX Security Symposium (USENIX Security 23). 2259\u20132273."},{"key":"e_1_3_3_1_61_2","unstructured":"Emma Woodward. 2024. History and Practice of CSIRT Map (full resolution image). https:\/\/osf.io\/8fknb\/ Accessed on November 08 2024."}],"event":{"name":"NSPW '24: New Security Paradigms Workshop","acronym":"NSPW '24","location":"Bedford PA USA"},"container-title":["Proceedings of the New Security Paradigms Workshop"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3703465.3703471","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3703465.3703471","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:08Z","timestamp":1750295888000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3703465.3703471"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,16]]},"references-count":60,"alternative-id":["10.1145\/3703465.3703471","10.1145\/3703465"],"URL":"https:\/\/doi.org\/10.1145\/3703465.3703471","relation":{},"subject":[],"published":{"date-parts":[[2024,9,16]]},"assertion":[{"value":"2025-01-16","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}