IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
- Which IT systems and IT applications will definitely not suffer any
damage or consequential damage?
- How high could any direct damage or consequential damage caused by the
security incident be? Particular attention should be paid here to the
dependence of the various IT systems and IT applications.
- What was the trigger for the security incident (e.g. carelessness, an
adversary or failure of the infrastructure)?
- When and in which location did the security incident occur? This could
actually be some time prior to when the security incident was first detected.
Well maintained log files can be extremely useful here, but only if one can
be sure that they have not been tampered with.
- Are only internal IT users affected by the security incident, or are external
third parties affected also?
- How much information regarding the security incident has already leaked
out to the public?
If it transpires that the security incident could have serious consequences then
it should be escalated to at least the next level.
Once these factors have been clarified, the options available must be specified.
These will consist of both immediate measures and supplementary measures.
The previously determined assignment of priorities should be considered here
(see S 6.62 Specifying priorities for handling security incidents). The time that
will be required to implement these measures and the cost and resources
which will be necessary to resolve the problem and restore normal operating
conditions must also be estimated.
If the level of the damage, the time required to repair the situation and the cost
of this exceed predefined limits, then the next higher escalation and decision
levels must be called in before any decisions are made as to which measures
should be selected. The outcome of a structured investigation and assessment
of a security incident on the lines outlined above will be the various options
available.
Additional controls:
- Is the necessary information generated from the definition of protection
requirements available to the persons receiving reports of security incidents
and the next escalation levels?
- Are any technical means available to support the evaluation of security
incidents, for example, tools for analysing logged data?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Consult log data
Determine actions