IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.60 Procedural rules and reporting channels for
security incidents
Initiation responsibility: Agency/company Management, IT Security
Management
Implementation responsibility: IT Security Management
Many security incidents only turn into serious problems because inappropriate
action was taken in response to them as a result of hasty decisions, for
example, resulting in the spontaneous deletion of data which was needed to
understand the event.
A distinction should be made here between generally applicable procedural
rules which apply to all imaginable security incidents and IT-specific
procedural rules. The following general procedural rules can be specified for
all types of security-relevant irregularities:
- All those involved should remain calm and desist from taking hasty
measures.
- Irregularities should be reported immediately in accordance with a
reporting plan.
- Countermeasures must not be taken until or unless they have been
requested by authorised persons.
- All the attendant circumstances must be explained frankly and
transparently and without any glossing over, so that the damage can be
minimised.
- Based on personal experience, an initial assessment of the potential extent
of the damage, the consequential damage, the parties both within and
without the organisation who are potentially affected and the possible
consequences should be performed.
- Information regarding the security incident should not be passed to third
parties without authorisation.
All staff in the agency/company who are potentially affected must be notified
of these general procedural rules in a suitable fashion.
In addition, specific procedural rules can be provided to those affected,
especially those in positions which are notified in cases of security incidents
and are expected to take the first decisions and/or initiate the first measures.
This includes IT Administrators, those responsible for IT applications and IT
Security Management. These procedural rules should cover the measures
described in
- S 6.23 Procedure in the event of computer virus infection
- S 6.31 Procedural patterns following a loss of system integrity
- S 6.48 Procedures in case of a loss of database integrity
- S 6.54 Procedures in case of a loss of network integrity
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Do not panic!
Proceed in an orderly
manner!
No covering up!
Damage assessment
Make procedural rules
known