Information Security Incident Management

It is practically impossible for any organization to be able to work without any incidents. This is because neither people nor systems and technologies are perfect. Information security incident management refers to the steps taken to identify, manage, record, and evaluate security incidents and threats associated with information security. In an information technology infrastructure, this is a highly crucial step to take either after or before a cyber disaster takes place.

In this chapter, we will look at the entire information security incident management process, starting with what a security incident is and moving on to the step-by-step process of incident management. This will be followed by an evaluation of the effectiveness of the process by implementing the appropriate controls. We will also look into how incident management is formed in an organization and the related standards to look into.

Security incidents are inevitable and...

Understanding security incidents and incident management

Figure 6.1 shows the representation of an occurrence of an incident. ISO 27000 defines a security incident as “a single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security” (https://www.iso.org/). There can be different sources of incidents, such as employees, clients, and third-party vendors. When an incident occurs or a weakness is discovered in a system or service, a mechanism must be established to ensure that an organization can respond quickly and effectively. The first thing that needs to be done to accomplish this goal is to devise a plan to handle any security problems that may arise.

ISO 27035 is the standard that talks in detail about information security incident management. Information security incidents and vulnerabilities can be identified, documented, assessed, responded to...

Information security incidents and breaches

If a company’s security policy is violated, it results in a security incident. It can be an event that compromises any one pillar of the Confidentiality, Integrity, and Availability (CIA) triad. A security breach is when an unauthorized entity gains access to the organization’s data, network, applications, or devices, which results in the disclosure of critical/sensitive information. An incident may or may not evolve as a breach.

Let us investigate a few examples to understand the difference between a security event, incident, and breach better:

• Let’s imagine that in the building of organization XYZ, a window that provides access to physical files with personally identifiable information is accidentally left open. This is an event. Now, if a couple of files are missing, resulting from this careless act, it results in an incident. If someone with malicious intentions gains access to the files and, as a result...

The incident management process

Preparedness is essential for being effective in the event of a significant incident. This is a common-sense statement, yet it is not always followed in practice. In most cases, only after a few major incidents have occurred it is common for an organization to develop a set of incident-handling procedures, testing and adjusting those processes to meet its needs. Some organizations only equip themselves to handle an issue in part, and a comprehensive system that can deal with any form of an incident may not be present.

The first step is to find out which security events should be investigated, and at what thresholds, by also considering the business continuity requirements of the organization. The next step is to draft a response strategy for each different kind of incident. It is possible to improve it through security event simulations, which allow you to uncover gaps in your process, but it will also be improved after actual events have occurred...

Understanding the controls related to incident management from Annex of ISO 27001:2022

Security incidents, events, and weaknesses are addressed in the Annex A controls from 5.24 to 5.28 and 6.8 of ISO 27001. These controls aim to ensure that incidents, events, and weaknesses are handled in a uniform and effective manner throughout their life cycle.

A.5.24 – information security incident management planning and preparation

To provide a prompt, efficient, and well-organized reaction to resolve vulnerabilities, events, and security incidents, the management of an organization needs to define roles, responsibilities, and procedures. An incident is where the CIA triad is affected.

Prior to the occurrence of an incident, the protocols for incident, event, and response planning need to be well established and approved by the leadership. During an audit, the formal, documented procedures are expected to be in place, along with evidence that they are working.

A.6.8 –...

Understanding the roles and responsibilities of the incident management team

An information security incident management process entails the steps necessary to finding, analyzing, and fixing issues, as well as speeding up the recovery of systems that have been compromised. An interdisciplinary team with a range of expertise is needed to address the myriad of challenges that may arise during this procedure. Management, IT and non-IT workers, physical security personnel, human resources, legal counsel, public relations specialists, reporters, and even emergency services may all be involved in the incident.

The incident response team manages cyberattacks, system failures, and data breaches. These teams may also create incident response plans, identify and fix system vulnerabilities, enforce security policies, and evaluate security best practices.

Incident management teams at various organizations may be referred to by different names, and except for a few differences, these teams...

ISO/IEC standards related to information security incident management

ISO/IEC 27035 is the guideline standard for information security incident management. There are also six other standards that relate to information security incident management in one way or the other. Let’s explore all seven standards as follows:

• ISO/IEC 27035 (Information technology – Security techniques – Information security incident management) (https://www.iso.org/): Information security incident management is explained, focusing on detection, reporting, evaluation, response, and lessons learned, which comprises three parts (https://www.iso.org/):
  • Part 1: The principles of incident management
  • Part 2: Guidelines for planning and preparing for incident response
  • Part 3: Guidelines for ICT incident response operations
• ISO/IEC 27037 (Information technology – Security techniques – Guidelines for identification, collection, acquisition, and preservation of digital evidence...

Summary

To conclude, reducing recovery costs, liabilities, and damage to information systems all depend on having a solid incident management process in place. The financial and operational effects of incidents can be mitigated through early detection and rapid response. It is essential to have an information security incident response plan in place to guarantee that your firm is prepared to deal with all information security problems. This reduces information security attack costs and prevents further breaches.

The framework or process for incident management is executed through a strong incident management team. The process itself takes inputs from the various standards published by ISO that relate to incident management.

In the next chapter, we will discuss the case studies of ISO 27001 implementation that relate to risk management, the implementation of controls, ISMS development stages, and incident management.