How to define a security incident
Do we need to do a better job of understanding exactly what a security incident actually is? Davey Winder takes a look...
Events or incidents?
Events, as it turns out, is a rather important word when it comes to understanding incidents. The US standards authority NIST defines a security incident as being "a computer security incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices."
But this, as Mike Small, analyst at Kuppinger Cole and ISACA security advisory group (SAG) member told me, is very different from an event.
"An event is any observable occurrence in a system or network. Events include a user connecting to a file share, a server receiving a request for a web page, a user sending email, and a firewall blocking a connection attempt," Small says.
There are also those 'adverse events' or those with negative consequences, such as system crashes, packet floods, unauthorised use of system privileges, unauthorised access to sensitive data, and execution of malware that destroys data. It's important to understand these differences in order to be able to determine what an incident is, and how to respond to it.
"Events trigger non-stop and often flood our event collectors (SIEMs) with sometimes millions of events per day," explains Ashley Stephenson, CEO of Corero Network Security. The challenge therefore, according to Stephenson, is to find the actual security incident among those events. "A security incident can therefore be defined as a collection of security events that equates to an actual security breach,'" he says.
If only it were that easy though, and often differentiating between an incident and something that had an impact is very subjective. "At Tenable, we get scanned everyday by botnets, internet scanners, malware and so on," says Ron Gula, Tenable Network Security CEO. "You need to be an expert to really determine if you are the next person on someone's list or you are indeed being targeted."
In This Article
2,000 days: the CIO's world in 2025
What the role of the CIO will look like in five years timeDownload now
The workers' experience report
How technology can spark motivation, enhance productivity and strengthen securityDownload now
6 best practices for escaping ransomware
A complete guide to tackling ransomware attacksDownload now
The IT roadmap from modernisation to innovation with consistent hybrid cloud
A guide to a modern, cloud-enabled IT infrastructureDownload now