IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.58 Establishment of a management system for
handling security incidents
Initiation responsibility: Agency/Company management
Implementation responsibility: IT Security Management
As IT is increasingly integrated into every area of an agency's or company's
operations, its correct functioning is becoming ever more critical. A major
function of IT Security Management is therefore to take sufficient proactive
measures to deal with security incidents of all kinds. Security incidents can be
triggered by many different events and, for example, result in loss of
availability, integrity and/or the confidentiality of data, individual IT systems
or the entire network.
The security incidents which require special handling by IT Security
Management are those which have the potential to cause significant damage.
Security problems which cause or can cause only minor damage which is
locally confined should be resolved locally so as to avoid overloading IT
Security Management.
Handling of security incidents is ultimately the responsibility of IT Security
Management and should be aimed at ensuring the following:
- the ability to respond so that security incidents and security problems are
detected and reported to the appropriate responsible person(s) promptly;
- the ability to decide whether it is a local security problem or constitutes a
security incident;
- the ability to take action so that in the event of a security incident the
necessary measures can be taken and implemented at short notice;
- minimisation of damage - this is achieved through prompt notification of
any other parts of the organisation which could be affected, and
- effectiveness - this is achieved by practising and monitoring the capability
to handle security incidents.
To achieve these objectives, a management system must be established for
dealing with security incidents. It is essential here that Management is
involved and ultimately puts the management system into effect so as to
ensure that the necessary awareness of IT security issues is generated,
decision-making responsibilities are assigned and the security objectives are
supported.
The steps described below provide a suggested approach as to how to establish
a management system handling security incidents.
Step 1: Inclusion in the security guidelines
The handling of security incidents is one aspect of IT security management
and, as such, should be spelt out in the security guidelines and/or IT security
policy of the agency or company. These documents must specify that security
incidents and security problems are to be reported by users and those affected
to the responsible security officer. In addition, the decision-making process
must be described and staff must be motivated as to the necessity of following
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Objectives in the
handling of security
incidents
Involvement of
Management