IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
the stipulated procedures. At the same time, inclusion in the security
guidelines is a way of demonstrating Management's support for IT security.
Step 2: Specification of responsibilities
This step entails specifying who has what responsibility in the event of
security incidents occurring. For example, the following groups might have
these responsibilities:
- IT users: report security problems and security incidents.
- IT Administrators: receive reports, take initial steps enabling decision as to
whether the occurrence is a security problem or a security incident, initiate
escalation.
- Person responsible for IT application: participate in decision process and
selection of measures in the light of own assessment of the degree of
protection required by the IT application.
- IT Security Officer or IT Security Management: receive reports, decide
whether it is a case of a security problem or a security incident, set
escalation in motion, implement necessary measures.
- Security Incident Team: a team composed of IT administrators, IT users,
IT Security Officers concerned, together with Public Relations staff and
possibly Management, for handling a security incident.
- Public Relations staff or Press Office: prepare information policy regarding
the security incident as required.
- IT Security Auditor: review management system and evaluate security
incident.
- Management: make final decisions
The responsibilities must be defined and put into effect. For further
information, see safeguard S 6.59 Specification of responsibilities for dealing
with security incidents.
Step 3: Procedural rules and reporting channel for handling security
incidents
To deal with security incidents effectively, it is essential that those affected
behave in a correct and level-headed manner and report the incident
immediately. The necessary procedural rules (keep calm, reporting obligation,
duty to provide information on attendant circumstances etc.) must be defined
and IT users trained accordingly. In particular, the person to whom IT security
problems or incidents should be reported must be determined.
Instructions on actions to be taken in the event of security incidents which
may typically be expected (e.g. appearance of a computer virus, manipulation
of data by insiders, hacking attempts by outsiders etc.) can be drawn up in
advance. If an emergency occurs, people will then be able to respond more
quickly so that the damage can be reduced. Since the effort required to prepare
these action options is not inconsiderable, it should be restricted to the
relevant areas in which it is possible to make plans.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Consider typical security
incidents in advance