DER.2.1 Security Incident Handling

Within an organisation, the meaning of the term “security incident” MUST be clearly defined. A security incident MUST be distinguished from disruptions during day-to-day operations whenever possible. All employees involved in handling security incidents MUST be familiar with the definition of a security incident. The definition and occurrence thresholds of such incidents SHOULD be based on the protection needs of the business processes, IT systems, and applications affected.

A policy governing the handling of security incidents MUST be prepared. This policy MUST define its purpose and objective and govern all aspects of handling security incidents. It MUST therefore describe codes of conduct for the different types of security incidents. In addition, there MUST be target-group-oriented and practically usable instructions for all employees. Furthermore, the interfaces with other management areas SHOULD be taken into account, including in business continuity management.

All employees MUST be familiar with the policy. It MUST be agreed by the IT Operation Department and approved by the organisation’s Top Management. The policy MUST be reviewed and updated regularly.

It MUST be specified who will be responsible for what in the event of security incidents. The tasks and competencies applicable in the event of security incidents MUST be defined for all employees. In particular, the employees who will handle security incidents MUST be informed of their tasks and competencies. In this context, it MUST be specified who will make the eventual decision regarding a forensic examination, the criteria to be followed in carrying it out, and when this should take place.

The employees MUST know the contact persons for all types of security incident. Contact information MUST always be updated and easily accessible.

When a security incident occurs, all the internal and external entities affected MUST be informed of the incident promptly. In this process, it MUST be checked whether the Data Protection Officer, the works council and personnel council, and employees from the legal department must be consulted. The reporting duties for public authorities and regulated industries MUST be taken into consideration, as well. Furthermore, it MUST be guaranteed that the entities affected are informed of the actions they need to take.

In order for a security incident to be remedied successfully, the person responsible MUST initially contain the problem and find the cause. They MUST then select the safeguards necessary to fix the problem. The head of the IT Operation Department MUST approve the safeguards before they are implemented. The cause MUST then be eliminated and a secure state established.

There MUST be a current list of internal and external security experts who may be consulted in the event of security incidents to answer questions from the subject areas involved. Secure communication methods with these internal and external entities MUST be established.

After a security incident, the affected components MUST be removed from the network. In addition, all necessary data that could provide information about the nature and cause of the problem MUST be backed up. On all the components affected, the operating systems and all applications MUST be checked for changes.

The original data MUST be reinstalled from write-protected data storage media. In so doing, all security-related configurations and patches MUST also be implemented. If data from backups is reimported, it MUST be ensured that the data was not affected by the security incident. After an attack, all access data on the affected components MUST be changed before they are put back into operation. The components affected SHOULD be subjected to a penetration test before they are used again.

When recovering the secure operating environment, the users MUST be involved in the functional tests of the applications. After everything has been recovered, the components (including the network transitions) MUST be monitored in a targeted manner.

A suitable procedure SHOULD be established for handling security incidents. The procedures and specifications for different security incidents SHOULD be clearly stipulated and documented appropriately. An organisation’s Top Management SHOULD implement the agreed procedure and make it accessible to everyone involved. Regular checks SHOULD be carried out to ensure that the procedure is still up to date and effective. The procedure SHOULD then be amended as required.

Appropriate organisational structures SHOULD be defined for handling security incidents. A security incident team SHOULD be established with members who may be called in depending on the type of incident. Even if the security incident team only meets when a specific incident has occurred, appropriate members SHOULD be appointed in advance and instructed on how to perform their tasks. Regular checks SHOULD be carried out to ensure that the composition of the security incident team is still appropriate. Changes SHOULD then be made to the security incident team as required.

Reporting channels SHOULD be established that are appropriate to the different types of security incidents. These SHOULD ensure that employees can report security incidents quickly and easily using reliable and trustworthy channels.

If a central contact point for reporting failures or security incidents is established, this SHOULD also be communicated to all employees.

There SHOULD be a communication and contact strategy. This strategy SHOULD specify who must be informed as a matter of principle, who may be informed, who is responsible for handling this and in what order, and the level of detail of the information provided. It SHOULD specify who will pass information about security incidents on to third parties. It SHOULD ensure that no unauthorised persons forward information on security incidents.

During the root cause analysis of a security incident, a decision SHOULD be taken on whether it is more important to contain the damage caused or to resolve the incident. Sufficient information SHOULD be available to be able to estimate the effects of a security incident. For certain security incident scenarios, worst-case considerations SHOULD be undertaken in advance.

A uniform procedure SHOULD be defined for classifying security incidents and disruptions. The classification procedure for security incidents SHOULD be coordinated between security management and fault (incident) management.

The interfaces among fault management, business continuity management, and security management SHOULD be analysed. In so doing, resources that these areas could use in tandem SHOULD also be defined.

The employees involved in fault management SHOULD be made aware of issues related to handling security incidents and business continuity management. The security management SHOULD have read-only access to the incident management tools used.

The handling of security incidents SHOULD also be coordinated with business continuity management. If a special fault management role has already been established in an organisation, this person SHOULD also be involved.

An escalation strategy SHOULD be formulated that goes beyond the communication and contact strategy at hand. This escalation strategy SHOULD be coordinated among the persons responsible for fault management and information security management.

It SHOULD contain clear instructions on who is to be involved in what way and when for each type of identifiable or suspected security incident. It SHOULD also specify the safeguards that are to follow an escalation and how those involved are to respond.

Suitable tools (e.g. ticket systems) SHOULD be selected for the defined escalation strategy. These SHOULD also be suitable for processing confidential information. It SHOULD be ensured that the tools will also be available during security incidents and emergencies.

The escalation strategy SHOULD be reviewed regularly and updated as required. The checklists (matching scenarios) for fault management SHOULD be complemented by security-relevant topics and updated regularly. The defined escalation paths SHOULD be tested by means of drills.

Service desk employees SHOULD have appropriate tools at their disposal to enable them to identify security incidents. They SHOULD be sufficiently trained to use the tools themselves. Service desk employees SHOULD be familiar with the protection needs of the IT systems in question.

The process of remedying security incidents SHOULD be documented in accordance with a standardised procedure. All actions performed and the respective times SHOULD be documented along with the log data of the components affected. In so doing, confidentiality SHOULD be guaranteed while documenting the information and archiving the reports.

The necessary information SHOULD be entered into the respective documentation systems before the disruption in question is considered over. The necessary quality assurance requirements SHOULD be defined in advance with the CISO.

Security incidents SHOULD be evaluated in a standardised manner. This SHOULD examine how quickly security incidents are detected and remedied. It should also investigate whether the reporting channels worked, whether sufficient information was available for evaluation, and whether the detection safeguards were effective. It SHOULD also check whether the implemented safeguards and activities were effective and efficient.

The experience gained from previous security incidents SHOULD be used to develop instructions for comparable security incidents. These instructions SHOULD be announced to the relevant groups of persons and updated at regular intervals on the basis of new findings.

An organisation's Top Management SHOULD be informed of the security incidents at annual intervals. If there is a need for immediate action, the Top Management MUST be informed immediately.

After a security incident has been analysed, there SHOULD be an investigation of whether the procedures for handling security incidents need to be changed or developed further. All those involved in the incident SHOULD report on their respective experiences.

Whether there are new developments in the field of incident management and forensics and whether these can be incorporated into the respective documents and procedures SHOULD be examined.

If checklists and auxiliary resources are being used (e.g. by service desk members), a check SHOULD be carried out on whether these should be complemented by relevant questions and information.

Priorities for handling security incidents SHOULD be established in advance and updated regularly. This SHOULD also take into account the classification of security incidents.

The priorities SHOULD be approved and implemented by an organisation’s Top Management. All those with decision authority who are involved in handling security incidents SHOULD be familiar with them. The defined priority classes SHOULD also be stored in an incident management system.

A dedicated office SHOULD be established for reporting security incidents. It SHOULD be guaranteed that the reporting office is available during normal office hours. However, it SHOULD also be possible for employees to report security incidents outside of normal office hours. The reporting office employees SHOULD be adequately trained and aware of issues related to information security. All information on security incidents SHOULD be treated confidentially within the reporting office.

A team of experienced and trusted experts SHOULD be established. Along with technical expertise, the members of the team SHOULD also have competences in the field of communication. The trustworthiness of the members of the team of experts SHOULD be checked. The composition of the expert team SHOULD be checked regularly and changed as necessary.

The members of the team of experts SHOULD be included in the escalation and reporting channels. The team of experts SHOULD be trained to analyse security incidents in the systems deployed in their organisation. The members of the team of experts SHOULD receive regular training in both the systems used and detecting and responding to security incidents. The team of experts SHOULD have access to any existing documentation and the financial and technical resources required to handle security incidents quickly and discretely.

The expert team SHOULD be appropriately considered and integrated into the organisational structures at hand. The responsibilities of the expert team SHOULD be coordinated in advance with those of the security incident team.

Regular checks SHOULD ensure that the management system for handling security incidents is still up to date and effective. To this end, both announced and unannounced drills SHOULD be conducted. The drills SHOULD be coordinated in advance with the Top Management of the organisation in question. The parameters that are measured when security incidents are recorded, reported, and escalated (e.g. the time from the initial report to the binding confirmation of a security incident) SHOULD be evaluated.

In addition, simulation exercises SHOULD be conducted on the handling of security incidents.