Applying Generic AcciMap to a DDOS Attack on a Western-European Telecom Operator

After a large incident on a telecommunications network, the operator typically executes an incident analysis to prevent future incidents. Research suggests that these analyses are done ad hoc, without a structured approach. In this paper, we conduct an investigation of a large incident according to the AcciMap method. We find that this method can be applied to telecommunications networks with a few small changes; we find that such a structured approach yields many more actionable recommendations than a more focused approach and we find that both the onset of an incident and the resolution phase merit their own analysis. We also find that such an analysis costs a lot of effort and we propose a more efficient approach to using this method. An unexpected outcome was that AcciMap may also be very useful for analyzing crisis organizations.