Cybersecurity Incident Report System

Databases for Data Science and Analytics (ITLB360)
International Business School (IBS), Budapest

---

1. Project Overview

This project implements a relational database system for managing cybersecurity incident reports within an organization.
It was developed as an individual coursework project for the MSc course Databases for Data Science and Analytics (ITLB360) at the International Business School (IBS), Budapest.

The system is designed to store, manage, and analyze cybersecurity incidents, the employees who report them, associated threat types, response actions, and employee cybersecurity training records.
The focus of the project is on sound database design, normalization, referential integrity, and practical SQL querying rather than application-level development.

---

2. Course Context and Requirements

As part of ITLB360, the project required:

• Designing a normalized relational database schema
• Creating an Entity–Relationship Diagram (ERD)
• Implementing the database using SQL (SQLite)
• Generating manufactured (synthetic) data with at least 10 records per table
• Writing a set of required SQL queries to answer analytical questions
• Demonstrating data integrity and reproducibility

This repository contains all technical artifacts needed to reproduce and inspect the database.

---

3. Problem Description

Organizations face a wide range of cybersecurity incidents, from phishing attempts to ransomware and insider threats.
To respond effectively, they need a structured way to:

• Record incident reports
• Categorize incidents by threat type
• Track response actions and their status
• Monitor employee training participation
• Analyze incident patterns and severity

This project models such a system at the database level, providing a structured foundation for reporting and analysis.

---

4. System Design Overview

The database consists of five core entities:

• Employee – staff members who report incidents and participate in training
• ThreatType – classification of cybersecurity threats
• IncidentReport – reported cybersecurity incidents
• ResponseAction – actions taken in response to incidents
• TrainingRecord – cybersecurity training participation records

Relationships are enforced using foreign keys, and integrity constraints are applied to ensure consistent and reliable data.

---

5. Database Schema and ER Diagrams

Two ER diagrams are included:

• Overview ER Diagram: high-level view of entities and relationships
• Detailed ER Diagram: includes attributes and keys

Location:

erd/diagrams/
├─ erd_overview.png
└─ erd_detailed.png

---

6. Implemented SQL Queries

The project includes six required SQL queries, each stored in a separate file for clarity and assessment alignment:

database/queries/
├─ Q01_required_query.sql
├─ Q02_required_query.sql
├─ Q03_required_query.sql
├─ Q04_required_query.sql
├─ Q05_required_query.sql
└─ Q06_required_query.sql

These queries address questions such as:

• Identifying critical incidents
• Analyzing incident reports by employee
• Finding common threat types
• Detecting missed training
• Identifying unresolved incidents

Additional analytical queries are provided in:

database/queries/extra/

These extend the analysis but are clearly separated from the required coursework queries.

---

7. Manufactured Data and Assumptions

All data included in this repository is fully synthetic and was created solely for academic purposes.

• No real individuals, organizations, or incidents are represented
• Names and scenarios are fictional
• Severity values follow a defined numeric scale

Seed data is provided as a single reproducible SQL script:

database/data/01_seed_data.sql

---

8. Tools and Technologies

• Database: SQLite
• SQL Client: DBeaver
• Diagramming: draw.io
• Version Control: Git & GitHub

The project is intentionally database-focused and does not include application-layer code.

---

9. Reproducibility Instructions

To recreate the database from scratch:

1. Create a new SQLite database
2. Execute the scripts in the following order:
   1. database/schema/01_schema.sql
   2. database/schema/02_constraints_indexes.sql
   3. database/data/01_seed_data.sql
   4. database/build/verify_db.sql
3. Review the verification output to confirm:
   • Row counts meet requirements
   • Referential integrity checks return zero errors

A verification screenshot is included in:

docs/screenshots/verify_db_results.png

---

10. Academic Integrity and AI Usage

This project was completed as an individual academic assignment.

• All design decisions and SQL implementations are my own work
• Manufactured data was created manually for this project
• AI tools were used only at a permitted level (idea clarification and structural guidance), with full responsibility for the final implementation taken by the author

Detailed disclosures are provided in:

docs/AI_USAGE.md
docs/ACADEMIC_INTEGRITY.md

---

11. Repository Structure

itlb360-cybersecurity-incident-db/
├─ database/
│  ├─ schema/
│  ├─ data/
│  ├─ queries/
│  └─ build/
├─ erd/
│  └─ diagrams/
├─ report/
│  └─ final/
├─ docs/
│  └─ screenshots/
└─ tools/

---

12. Note on the Included Report

The full written report (DOCX/PDF) is included in this repository for academic and portfolio demonstration purposes only.
It does not include grades, rubrics, or instructor feedback.

Reuse or redistribution of the report should respect academic integrity principles.

---

Author

Individual MSc coursework project
International Business School (IBS), Budapest