How to define a security incident

Do we need to do a better job of understanding exactly what a security incident actually is? Davey Winder takes a look...

Events or incidents?

Events, as it turns out, is a rather important word when it comes to understanding incidents. The US standards authority NIST defines a security incident as being "a computer security incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices."

Advertisement - Article continues below

But this, as Mike Small, analyst at Kuppinger Cole and ISACA security advisory group (SAG) member told me, is very different from an event.

"An event is any observable occurrence in a system or network. Events include a user connecting to a file share, a server receiving a request for a web page, a user sending email, and a firewall blocking a connection attempt," Small says.

There are also those 'adverse events' or those with negative consequences, such as system crashes, packet floods, unauthorised use of system privileges, unauthorised access to sensitive data, and execution of malware that destroys data. It's important to understand these differences in order to be able to determine what an incident is, and how to respond to it.

"Events trigger non-stop and often flood our event collectors (SIEMs) with sometimes millions of events per day," explains Ashley Stephenson, CEO of Corero Network Security. The challenge therefore, according to Stephenson, is to find the actual security incident among those events. "A security incident can therefore be defined as a collection of security events that equates to an actual security breach,'" he says.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

If only it were that easy though, and often differentiating between an incident and something that had an impact is very subjective. "At Tenable, we get scanned everyday by botnets, internet scanners, malware and so on," says Ron Gula, Tenable Network Security CEO. "You need to be an expert to really determine if you are the next person on someone's list or you are indeed being targeted."

Featured Resources

Key considerations for implementing secure telework at scale

Identifying the security risks and advanced requirements of a remote workforce

Download now

The State of Salesforce 2020

Your guide to getting the most from Salesforce

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Rethink your cybersecurity strategy for the new world

5 steps to secure the enterprise and be fit for a flexible future

Download now
Advertisement

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
Police use of facial recognition ruled unlawful in the UK
privacy

Police use of facial recognition ruled unlawful in the UK

11 Aug 2020