IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.61 Escalation strategy for security incidents
Initiation responsibility: Agency/company Management, IT Security
Management
Implementation responsibility: IT Security Management
Once the responsibilities for security incidents have been determined (see
S 6.59 Specification of responsibilities for dealing with security incidents) and
the procedural rules and reporting channels are familiar to all those concerned
(see S 6.60 Procedural rules and reporting channels in case of security
incidents), the next step is to determine how to proceed once reports have been
received.
As a first step, the person receiving a report regarding a security incident must
investigate and assess it (see also S 6.63). If it turns out to indeed be a case of
a security incident, additional measures must be taken. The following
questions arise:
- Where escalation is required, i.e. the action chain is extended, who should
be informed?
- What cases require immediate escalation?
- Under what other circumstances is escalation appropriate?
- When should escalation occur (immediately, the next day, the next working
day)?
- What media should be used to pass on the report?
The answers to these questions must be specified in an escalation strategy and
made known. The escalation strategy can be created in three stages, as
follows:
Stage 1: Specification of escalation channels
Who is responsible for handling security incidents is specified in safeguard
S 6.59 Specification of responsibilities for dealing with security incidents.
Specification of the escalation channel should include defining who should
send a report to whom. This is easy to see when the relevant hierarchy is
presented in diagrammatic form. Both the regular escalation channels and also
the channels to be used during staff absences should be considered.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Who informs whom?