Discussion and Replies

15

Information Security

Incident Management The “Information Security Incident Management” clause is new in the second edition, but it is

mostly composed of existing controls. The five controls and two control objectives focus on

notification, containment, and management of information security incidents. Management should

closely review this clause to ensure that their environment and operations fully address the

controls in this clause.

REPORTING INFORMATION SECURITY EVENTS AND WEAKNESSES

Information security incidents can quickly elevate to organizationwide catastrophes and,

therefore, management should develop and implement a formal mechanism to report and manage

all information security weaknesses and incidents.

13.1.1 — REPORTING INFORMATION SECURITY EVENTS

Scope: Identified or suspected information security events should be reported to well-known

management channels as quickly as possible. All users should be keenly aware of the security

incident reporting process and aware of the scenarios and events that define an incident.

Key Risk Indicator: Yes

Control Class: (M) Management, (O) Operations

Key Questions:

Does the organization have a formal information security incident reporting process and

mechanism? If so, please describe the program and process.

How are all organizational users and relevant third parties trained and made aware of their

responsibilities for quickly reporting information security incidents?

How frequently is the information security incident process tested?

Layton, Timothy P.. Information Security : Design, Implementation, Measurement, and Compliance, Auerbach Publishers, Incorporated, 2006. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=267956. Created from apus on 2025-05-22 04:41:33.

Copyright © 2006. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 184-187 | Printed page 1 of 5

Additional Information: Information security incident reporting is not a standalone process.

This should be a part of a larger business process. Most organizations reference this type of

process as an incident response system, emergency response plan, etc. The number one objective

is for all users (employees, consultants, contractors, vendors, etc.) to be aware of, and trained on,

the process of reporting security incidents through appropriate channels. As I previously stated in

the awareness control, it is not enough for users to be aware of how to perform this mission-

critical task. They should be trained on the process, and regular and random testing should occur

to ensure that the users are trained and understand the process.

This is a difficult control because it cannot be implemented on its own, as it needs to be a part

of the larger incident response system as I briefly outlined in the preceding paragraph. Designing,

implementing, and training the users on a formal incident response system is a large undertaking,

even for smaller organizations. For larger organizations, the cost can be aggressive and the

information security management team will be expected to design and provide the scope for this

type of project.

13.1.2 — R S WEPORTING ECURITY EAKNESSES

Scope: All suspected or identified security weaknesses should be reported to management

through a formal process. Every user or relevant third party associated with the organization

should bear this responsibility and be aware of the process.

Key Risk Indicator: No

Control Class: (M) Management, (O) Operations

Key Questions:

Does your organization require all users to report suspected and identified security

weaknesses?

What type of training does your organization provide to the entire user body on the concept

of security weaknesses?

Do all users understand what to do, and not to do, if a suspected security weakness is

identified?

Additional Information: There are two dimensions to this control. The first is to create an

environment and associated process to enable users of the organization’s information systems and

facilities to report any observed or suspected weaknesses or threats to the proper authority. The

second dimension is awareness and education. Users must be continually reminded of the type of

threats and weakness that they might be exposed to. Many of the high-priority topics could be Layton, Timothy P.. Information Security : Design, Implementation, Measurement, and Compliance, Auerbach Publishers, Incorporated, 2006. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=267956. Created from apus on 2025-05-22 04:41:33.

Copyright © 2006. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 184-187 | Printed page 2 of 5

covered in the organization’s information security awareness and education campaign. The point

of departure for this control is to identify the weakness or threat quickly and to match the

discovery with the proper authority. A trained and aware staff is one of the best information

security investments any organization can ever make. People are the missing link for information

security. A balance of technical and operational controls is necessary, and an aware user base is

equally important to the information security protection strategy.

MANAGEMENT OF INFORMATION SECURITY INCIDENTS AND

IMPROVEMENTS

Managing information security incidents is challenging and stressful. Clear documentation

outlining responsibilities and actions should be provided by management for the handling of

information security incidents.

13.2.1 — R PESPONSIBILITIES AND ROCEDURES

Scope: Information security-related incidents can create panic and stress for all parties.

Management responsibilities and associated procedures should be developed when there are no

incidents under way to allow for clear thinking and the development of effective procedures.

Key Risk Indicator: No

Control Class: (M) Management, (O) Operations

Key Questions:

Does your organization have written procedures for handling information security incidents?

If so, are all users, including management, fully aware and trained on their responsibilities?

How does your organization monitor for potential information security incidents?

When is the last time management tested procedures for incident management?

13.2.2 — L I S IEARNING FROM NFORMATION ECURITY NCIDENTS

Scope: Management should develop a method and system to ensure that information is properly

collected during an incident to ensure that it can be analyzed after the incident for learning and

evaluation for improvement.

Key Risk Indicator: No

Control Class: (M) Management

Key Questions:

Layton, Timothy P.. Information Security : Design, Implementation, Measurement, and Compliance, Auerbach Publishers, Incorporated, 2006. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=267956. Created from apus on 2025-05-22 04:41:33.

Copyright © 2006. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 184-187 | Printed page 3 of 5

What type of methods or processes has management developed and published to collect all

key information during an incident?

Is there a process in place for management to review an incident after it is fully eradicated?

Additional Information: In many cases this type of analysis may be a part of the incident

response and management system. If not, a separate process should be developed to quantify the

direct and indirect costs to the organization so that management can be properly informed. A

formal report should be produced as a result of this process and exercise. The resulting

information can help the management team identify any patterns that require immediate attention.

In addition, the information security management team can utilize the information to review the

associated control to ensure that they are appropriate in scope and applied. Furthermore, any

associated information security policies should be reviewed and updated if necessary.

13.2.3 — C EOLLECTION OF VIDENCE

Scope: Many times, information security incidents can have legal implications. Special care

should be taken by management to develop and publish procedures and guidelines for the

collection of evidence.

Key Risk Indicator: No

Control Class: (M) Management, (O) Operations, (T) Technical

Key Questions:

How does your organization handle the collection of evidence during an information security

incident?

How does your organization make users aware that evidence is a part of the information

security incident process?

SUMMARY

“Information Security Incident Management” is a new security clause for the second edition, but

the concept and some controls were carried over from the first edition. Management should

develop and publish a clear set of procedures and guides for the reporting of security incidents

(13.1.1) and weaknesses (13.1.2). Management must be clear on its responsibilities (13.2.1), and

there should be a mechanism for learning (13.2.2) from incidents as well as an awareness and

procedures for collecting evidence (13.2.3).

REFERENCES Layton, Timothy P.. Information Security : Design, Implementation, Measurement, and Compliance, Auerbach Publishers, Incorporated, 2006. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=267956. Created from apus on 2025-05-22 04:41:33.

Copyright © 2006. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 184-187 | Printed page 4 of 5

ISO/IEC 17799:2005 Information Technology — Security Techniques — Code of Practice for Information

Security Management, International Organization for Standardization, 2005.

Layton, Timothy P.. Information Security : Design, Implementation, Measurement, and Compliance, Auerbach Publishers, Incorporated, 2006. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=267956. Created from apus on 2025-05-22 04:41:33.

Copyright © 2006. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 184-187 | Printed page 5 of 5