In practice, it is impossible to completely eliminate the possibility of security incidents occurring. This remains the case even when numerous security safeguards are implemented. That said, responding inappropriately to acute security incidents (or not at all) may result in major damage with catastrophic consequences. Consider the following examples:

• Suspicious entries are found in the log files of a firewall. If there is no prompt examination of whether this is the first sign of a possible incursion, attackers may successfully overcome the firewall without being noticed and penetrate the internal network of the respective organisation.
• Security vulnerabilities emerge in the IT systems and applications used by an organisation. If the organisation does not obtain this information in time and fails to take the necessary countermeasures quickly, these vulnerabilities can be exploited by attackers.
• A burglary at a branch office of a company is assumed to be a case of drug-related crime because laptops and flat-screen monitors were the only objects stolen. The fact that confidential information and access data for IT systems in the company's intranet were stored on the laptops was not considered important. The CISO was therefore not informed. As a result, the organisation is not prepared for the subsequent attacks on the IT systems its headquarters and other sites. The data found on the stolen laptops was used for the attacks.

In urgent, high-stress situations, poor decisions may be made if there is no appropriate procedure prescribed for handling security incidents. Such decisions could lead to the press being misinformed, for example. In addition, third parties could be damaged by an organisation’s IT systems and claim compensation. If the affected organisation has not planned fallback or recovery safeguards, the damage it suffers will be significantly greater.

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)