IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.62 Specifying priorities for handling security
incidents
Initiation responsibility: Agency/company Management, IT Security
Management
Implementation responsibility: IT Security Management
Experience suggests that security incidents are the result of a conjunction of
different causes. As a consequence it is generally the case that the resulting
potential damage involves several categories of damage (for example,
impairment of physical integrity of a person, negative effects on external
relationships, financial consequences, see also Section 2.2, Determination of
protection requirements). It is therefore important to establish as far in
advance as possible exactly where priorities lie with regard to dealing with
problems. This priority assignment determines among other things the
sequence in which problems should be tackled.
The assignment of priorities depends heavily on an organisation's particular
circumstances. To assign priorities, the following questions should be
considered:
- What categories of damage are relevant to the organisation?
- In what order should damage in the individual damage categories be
rectified?
In answering these questions, it can be helpful to work through a procedure for
determining protection requirements from the IT baseline protection point of
view (see Section 2.2). This procedure for determining protection
requirements defines the damage categories which are relevant to the
organisation.
Examples of relevant damage categories are as follows:
- Violation of laws, regulations or contracts
- Impairment of the right to informational self-determination
- Impairment of the physical integrity of a person
- Impaired performance of duties
- Negative effects on external relationships
- Financial consequences
As part of the exercise of specifying the protection requirements, the extent of
the damage is defined for each damage category.
Example: damage category "financial consequences"
Damage category: financial consequences
Damage / loss = medium Damage or loss is less than DM
25,000
Damage / loss = high Damage or loss is between DM
25,000 and DM 5 million
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Security incidents
compete with other
problems
How serious is the
damage?