IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.64 Remedial action in connection with security
incidents
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management, Head of IT Section,
Administrator
As soon as the cause of a security incident has been identified, the measures
needed to deal with it should be selected and implemented. This requires first
of all containing and removing the problem, and then restoring the "normal"
state of affairs.
Supplying the necessary expert knowledge
To investigate and deal with a security weakness, it is essential to have the
relevant technical knowledge. Therefore either staff must have the appropriate
training or else experts will have to be called in. For this purpose, a list
containing the contact addresses of appropriate internal and external experts
from the various subject areas must be prepared so that they can be called
upon for advice without delay. External experts include
- Computer Emergency Response Teams (CERTs) (see also S 2.35
Obtaining information on security weaknesses of the system),
- vendors and distributors of the IT systems concerned (see also S 4.107 Use of
vendor resources),
- vendors and distributors of security systems used such as anti-virus programs,
firewalls, access control etc.,
- external consultants with specialist security expertise.
Restoring secure operations
To eliminate any security weaknesses, the IT systems concerned must be
taken off the network and all the files which could provide any information
about the nature and cause of the problem which has occurred must be backed
up. This includes especially all relevant log files. As the entire IT system
should be viewed as insecure or as having been tampered with, the operating
system and all the applications must be examined for changes. In addition to
programs, configuration files and user files must also be examined for possible
manipulation. It is appropriate here to use checksum procedures. However,
this presupposes that the checksums associated with the "secure" condition
have been ascertained in advance and transferred to write-protected data
media (see also S 4.93 Regular integrity checking).
To be certain that any Trojan horses left behind by an adversary have really
been removed, the original files should be reimported from write-protected
data media. Care should be taken here that all security-relevant configurations
and patches are also imported as well. Where files are reimported from data
backups, steps must be taken to ensure that these have not been affected by the
security incident, i.e. they have not already been infected with the computer
virus. On the other hand, examination of the data backups may be helpful in
order to establish when the attack began or when infection with a computer
virus occurred.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
List of addresses of
experts
Investigation of the
affected IT systems
Be cautious about
importing data backups