Information Systems Security Manager (ISSM) - Marine Corps ...

NAVSO P-5239-04SEPTEMBER 19953.8 Incident and Violations ReportingSecurity incidents or violations are occurrences that may affect the security posture ofthe IS. Security incidents or violations include the following:· Suspected or confirmed viral infection· Intrusion attempts and successes within the IS, such as:- Remote users logging in with compromised passwords- Compromised administrative privileges, allowing the creation of and use of falseuser accounts.· Access denials, such as:- Incorrect password violations- Incorrect account/user names- Unauthorized access to certain files, directories, servers, or other resources on theIS.ResponsibilityAll suspected incidents or violations must be reportedimmediately, first by the ISSO to the ISSM, and then afteranalysis by the ISSM, to the NAVCIRT and the DAA. TheISSM is responsible for approving the incident reportingmechanism.ImplementationIncident ReportingMechanismThe ISSM ensures that the mechanism facilitates the reportingof:· All access denials, repeated failed logon attempts, andother unusual activities· Viruses or suspected viruses and the forwarding of allvirus reports to NAVCIRT· All intrusion attempts/successes.The ISSM ensures that the incident reporting mechanism meetsCommand and INFOSEC requirements. The mechanismshould include the following, at a minimum:· Warning message and warning report monitoring· Access denial proceedings· Security problem analysis· Investigation of actual or suspected compromise of34