IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
correct reporting in order to bring home to staff just how important it is to
report security incidents.
Motivation of perpetrator
If it turns out that the security incident was due to deliberate action, the
perpetrator's motivation should be investigated. The motivation is especially
important when an insider is involved. If it transpires that the cause lies in the
organisation environment, this should be notified to Management as it can
then be expected that mistakes and/or deliberate action will occur again.
Depending on the relevance of the evaluation results, Management should be
informed so that it can arrange for improvements. It can therefore be sensible
to have this evaluation performed by an organisational unit which is not part
of the reporting plan.
Development of instructions on actions to be taken
As part of the evaluation of a security incident it is useful to use the results to
prepare instructions on actions to be taken or to review the procedures to be
followed in the event that a similar security incident occurs again. Once
practical experience of the problems is available, instructions on actions to be
taken can be developed more efficiently than when the authors are working
purely on a theoretical basis. The security incident which occurred also shows
that there is a specific need for instructions on the actions to be taken for this
type of security incident. Instructions so prepared should be notified to the
relevant groups of persons in an appropriate manner.
Additional controls:
- Were the most recent security incidents evaluated?
- Is Management informed once a year about the security incidents?
- How are the specific instructions on actions to be taken updated and
communicated?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000