IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
damage all the other internal departments and external agencies affected must
be notified. To accelerate notification, the communication channels should be
ascertained and a dependency analysis should be carried out in advance (see
S 6.65 Notification of the parties affected).
Step 9: Evaluation of a security incident
To ensure that the appropriate lessons are learnt from a security incident
which has occurred, the procedure to be adopted for evaluating the handling of
security incidents should be specified. Often this will result in improvements
in dealing with security incidents or permit conclusions to be drawn as to the
effectiveness of the IT security concept. The aspects to be considered here
include the following:
- Time taken to react
- Extent of awareness of the reporting channel
- Effectiveness of the escalation strategy
- Effectiveness of the investigation
- Means for notifying affected parties
This subject is addressed in detailed in safeguard S 6.66 Evaluation of security
incidents.
Step 10: Use of detection measures for security incidents
The sooner a security incident is detected and reported, the more effectively
can countermeasures be taken. Any automated detection measures available
should be used so as to reduce any delays induced by reliance on human
actions. Examples of such measures are anti-virus programs, analysis of
logged data and intrusion detection systems. Identification and activation of
these measures and the related communication channels are described in
safeguard S 6.67 Use of detection measures for security incidents.
Step 11: Effectiveness testing
In order to be able to measure the effectiveness of a management system for
the handling of security incidents and promote the necessary practice at these
management tasks, exercises and gaming should be performed. As these may
require considerable personnel resources and can interfere with normal
operations, they should be confined to important areas. Further suggestions
will be found in safeguard S 6.68 Testing the effectiveness of the management
system for the handling of security incidents.
The results of these steps should be documented appropriately in a "Concept
for handling security incidents" paper. This concept should be updated at
regular intervals and be notified to those affected in a suitable way.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Develop concepts and
update regularly