IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more
In-depth

How to define a security incident

Do we need to do a better job of understanding exactly what a security incident actually is? Davey Winder takes a look...

Asking 'what is a security incident?' may seem like something of a silly question, however when Lancope recently conducted a survey of IT and security professionals the results pointed towards the answer being far from straightforward.

Indeed, with some 65 per cent of those asked apparently being in security incident denial, there is an argument to suggest that there is a systemic problem in understanding security within the enterprise.

I started by asking Kurt Hagerman, FireHost's director of information security, the question and he admitted that it's a lot harder to answer than it seems. "It's a funny thing really. Everyone thinks that they know what a security incident is, but in truth there are a number of different definitions and they don't all sit well together," he says.

Although the most basic of definitions would appear to classify an incident as 'an intrusion or attempted intrusion' Hagerman argues that the enterprise needs to define the term within the context of their operations.

Lisa Myers, virus hunter at Intego, agrees that organisations will define the term depending on the importance of security to their specific industry. "Organisations that are under more frequent attack will likely define it differently than those that are attacked more seldom," Myers points out. She adds: "Those with more sensitive or potentially life-threatening data will define it differently from those with limited data." This is true, but perhaps not very helpful in getting us closer to that elusive definition.

Most of the security industry professionals that I spoke to agreed on one important thing: the need for any definition to be 'high level.'

"[By] being too specific you run the risk of missing certain incidents," warns Alan Carter, head of consulting at SecureData. "For example, defining SQL attacks as a security incident could result in a new type of attack not being defined in future."

So can we come up with a high-level, broad church, definition? Andrew Wild, CSO at Qualys believes he can. "At a very high level, an information security incident should be considered an event that impacts the confidentiality, integrity, or availability of an information resource or asset," he says.

The organisation's information security management team, in coordination with its executive management and the incident response team, should then determine responsibilities for managing specific types of likely events, according to Wild.  

Featured Resources

Meeting the future of education with confidence

How the switch to digital learning has created an opportunity to meet the needs of every student, always

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

Technology reimagined

Why PCaaS is perfect for modern schools

Free Download

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
Attracting and retaining talent through training
Sponsored

Attracting and retaining talent through training

13 Jun 2022
Delivery firm Yodel disrupted by cyber attack
cyber attacks

Delivery firm Yodel disrupted by cyber attack

21 Jun 2022