COI Report – Part VII
Page
403 of
425 “Security incident means the attempted or successful unauthorized access, use,
disclosure, modification, or destruction of information or interference with system operations in an information system.”
113
(emphasis added)
1170. Another example is the definition of a computer security incident in the
NIST Computer Security Incident Handling Guide:
114
“A computer security incident is a violation or imminent threat of violation
of computer security policies, acceptable use policies, or standard security practices
.”115
(emphasis added)
1171.
In other words, the definition must unambiguously and clearly state the both
attempts and
successful attacks are to be reported. Further, staff can be encouraged to err on the side of over-reporting. Bruce said that IHiS has now implemented two policies a) For all staff to keep their reporting officers informed if the incident is not resolved within 24 hours and b) To inform supervisors even of incidents that turnout not to be security-related.
1172. These are steps in the right direction. The IR plan should emphasise that, where staff are unclear on the definition or on how to apply the definition
to the current situation, they should seek guidance and report the incident so that it can be properly assessed.
113 45 CFR (US) § 164.304: Definitions.
114
NIST.SP.800-61 Revision 2.
115
Ibid at [2.1].
