The incidents of information security can be detected by any employee, and automatically (for example, by activating an antifraud module).
Upon detection of an information security event, an employee is obliged to:
• Take steps to contain the incident: stop (suspend) work, shut down the computer by shutting down
• Inform the line manager and the Head of the Information Security and Data Protection Unit.
• If possible, take steps to save evidence of the incident (screenshots, save copies of documents).
When an information security event is automatically detected, the Head of the Information Security and Data Protection Unit:
• Analyze the cause and risk group of suspicious programs
Information security incident log
Once the information on an information security event has been received, the Head of the Information Security and Data Protection Unit, with the intervention of computer specialists, analyzes the information to classify it as an information security incident and prepare a report.
The criteria for classifying an information security event as an incident are violations of the following types of events.
a) Physical level of the information infrastructure:
• Physical access of employees and other people to the facilities.
• The physical access of employees and other people and the use of computer equipment by the aforementioned entities.
• Use by employees and others of copying devices and multifunctional devices.
• The use of fax communication equipment by employees and others.
• Changes in the configuration of computer and telecommunications equipment.
• Changes in the configuration parameters of the equipment that guarantee the operation of the computer equipment.
• Failures and malfunctions of computer and telecommunications equipment.
• Failures and malfunctions of the devices that guarantee the operation of the computer equipment.
• Failures and deficiencies in information security facilities.
• Failures and falls in telephone communication networks.
• Failures in data transmission networks.
• Physical impact on computer equipment, telecommunications equipment, information protection equipment and data transmission networks.
• Changes in the climatic conditions of the facilities where the computer and telecommunications equipment are located.
• Replacement and / or modification of pieces of software and / or hardware of computers and telecommunications equipment.
• Transfer of computer equipment between subdivisions of the organization
• Transfer of computer equipment to external organizations.
• Carrying out access activities to television security surveillance systems, burglar alarm systems, access control and management systems.
• ...
b) Network equipment level:
• Changes to the software configuration of the network equipment.
• Changes in the composition and versions of the software of the network equipment.
• Detection of abnormal activity on the network.
• Authentication and termination of the session on the computers on the network.
• Malicious code detection and its manifestations.
• Changing the topology of computer networks.
• Connection of equipment to computer networks.
• Network equipment software update.
• Carry out maintenance operations on network equipment.
• Failures in the operation of information security tools.
• Launch of computer network topology analysis tools.
• ...
c) Application and network services layer:
• Identification, authentication, authorization and termination of the session of the organization's employees and others.
• Change the settings, composition and versions of the software.
• Malicious code detection and its manifestations.
• Establishment of connections and processing of requests, including remote ones, at the level of applications and network services.
• Failures in the operation of information security measures.
• External influences from the Internet, including attacks on the network.