IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
This topic is covered in detailed in safeguard S 6.60 Procedural rules and
reporting channels in the event of security incidents.
Step 4: Escalation strategy for security incidents
The more critical a security incident is, the greater the authority that is
required as a rule to deal with the security incident. In the extreme this can
mean that Management has to be informed and involved early in order that
necessary measures such as a ban on divulging any information, calling in the
police, taking costly alternative measures can be implemented. However, this
requires that an escalation strategy specifying who should be consulted in
what cases is drawn up in advance. Further information on this is provided in
safeguard S 6.61 Escalation strategy for security incidents.
Step 5: Setting priorities
Because security incidents are generally the culmination of a chain of different
causes and affect different IT application areas, the measures to be adopted
should be implemented with the aid of a priority list. This setting of priorities
depends on the protection requirement, the range of IT applications and the
individual dependencies of the agency/company. Just as is necessary when
determining the protection requirements, a list of priorities must be drawn up
in advance for the purpose of specifying the order in which damage resulting
from a security incident should be tackled (see S 6.62 Specifying priorities for
handling security incidents).
Step 6: Methodology for investigating and assessing security
incidents
Once a security-relevant irregularity has been reported, a decision must be
made initially as to whether it can be regarded as a local security problem or
constitutes a potentially more damaging security incident. A number of factors
have to be ascertained and assessed before this decision can be made (the
extent of the potential damage and consequential damage, the cause, which IT
systems are affected, what immediate measures are required). If necessary, the
next levels of management should be consulted, as specified in an escalation
strategy. Further details will be found in safeguard S 6.63 Investigation and
assessment of a security incident.
Step 7: Implementation of measures for taking remedial action in
connection with security incidents
When implementing the measures necessary to remedy security incidents, it
should be borne in mind that these measures will generally have to be
implemented under time pressure. Therefore it is not inconceivable that the
measures taken could themselves create new problems. Consequently it is
important to document implementation of the measures adequately.
Furthermore, assuming that the incident is the result of wilful action, the
question of how the "perpetrator" should be dealt with should also be thought
about. In some circumstances there may be personnel implications. For further
information, see S 6.64 Remedial action in connection with security incidents.
Step 8: Notification of the parties affected
If it transpires that the impact of a security incident is not confined to the
agency/company or individual organisational unit(s) concerned, to contain the
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000