How to define a security incident

Do we need to do a better job of understanding exactly what a security incident actually is? Davey Winder takes a look...

Events or incidents?

Events, as it turns out, is a rather important word when it comes to understanding incidents. The US standards authority NIST defines a security incident as being "a computer security incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices."

But this, as Mike Small, analyst at Kuppinger Cole and ISACA security advisory group (SAG) member told me, is very different from an event.

"An event is any observable occurrence in a system or network. Events include a user connecting to a file share, a server receiving a request for a web page, a user sending email, and a firewall blocking a connection attempt," Small says.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

There are also those 'adverse events' or those with negative consequences, such as system crashes, packet floods, unauthorised use of system privileges, unauthorised access to sensitive data, and execution of malware that destroys data. It's important to understand these differences in order to be able to determine what an incident is, and how to respond to it.

"Events trigger non-stop and often flood our event collectors (SIEMs) with sometimes millions of events per day," explains Ashley Stephenson, CEO of Corero Network Security. The challenge therefore, according to Stephenson, is to find the actual security incident among those events. "A security incident can therefore be defined as a collection of security events that equates to an actual security breach,'" he says.

If only it were that easy though, and often differentiating between an incident and something that had an impact is very subjective. "At Tenable, we get scanned everyday by botnets, internet scanners, malware and so on," says Ron Gula, Tenable Network Security CEO. "You need to be an expert to really determine if you are the next person on someone's list or you are indeed being targeted."

Featured Resources

2,000 days: the CIO's world in 2025

What the role of the CIO will look like in five years time

Download now

The workers' experience report

How technology can spark motivation, enhance productivity and strengthen security

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now

The IT roadmap from modernisation to innovation with consistent hybrid cloud

A guide to a modern, cloud-enabled IT infrastructure

Download now
Advertisement

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/security/cyber-security/354468/if-not-passwords-then-what
cyber security

If not passwords then what?

8 Jan 2020
Visit/policy-legislation/31772/gdpr-and-brexit-how-will-one-affect-the-other
Policy & legislation

GDPR and Brexit: How will one affect the other?

9 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020