How to define a security incident

Do we need to do a better job of understanding exactly what a security incident actually is? Davey Winder takes a look...

Events or incidents?

Events, as it turns out, is a rather important word when it comes to understanding incidents. The US standards authority NIST defines a security incident as being "a computer security incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices."

But this, as Mike Small, analyst at Kuppinger Cole and ISACA security advisory group (SAG) member told me, is very different from an event.

"An event is any observable occurrence in a system or network. Events include a user connecting to a file share, a server receiving a request for a web page, a user sending email, and a firewall blocking a connection attempt," Small says.

There are also those 'adverse events' or those with negative consequences, such as system crashes, packet floods, unauthorised use of system privileges, unauthorised access to sensitive data, and execution of malware that destroys data. It's important to understand these differences in order to be able to determine what an incident is, and how to respond to it.

"Events trigger non-stop and often flood our event collectors (SIEMs) with sometimes millions of events per day," explains Ashley Stephenson, CEO of Corero Network Security. The challenge therefore, according to Stephenson, is to find the actual security incident among those events. "A security incident can therefore be defined as a collection of security events that equates to an actual security breach,'" he says.

If only it were that easy though, and often differentiating between an incident and something that had an impact is very subjective. "At Tenable, we get scanned everyday by botnets, internet scanners, malware and so on," says Ron Gula, Tenable Network Security CEO. "You need to be an expert to really determine if you are the next person on someone's list or you are indeed being targeted."

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021