Fundamental principles and concepts of information security incident management
Events, incidents and vulnerabilities
ISO/IEC 27035 draws a deliberate line between an information security event - an identified occurrence indicating a possible breach of policy or failure of safeguards - and an information security incident, a single event or series of events with a significant probability of compromising business operations and threatening information security. A vulnerability is a weakness that could be exploited; it becomes an incident only through an event. A near miss is an event caught before impact and should still be recorded.
Purpose and principles
Incident management exists to contain harm, restore normal service, preserve evidence and learn. It is a management process, not a helpdesk queue: it needs ownership, authority and communication. Core principles: protect people and safety first; act proportionately to severity; preserve evidence proportionate to legal need; keep need-to-know communications; document decisions as they happen; treat every incident as an improvement input.
Roles and structures
An incident manager coordinates and decides; a CSIRT/CIRT investigates and responds; system and data owners remediate; senior management authorises exceptional actions; legal, HR, communications and privacy advise. Teams may be internal, coordinated across organisations, or national.
Worked example
A user reports a suspicious email. Triage finds no click - the event is logged as a phishing attempt and closed. Two days later, a mailbox rule forwards finance mail externally. That is a series of related events with probable business impact: an incident, severity high, escalated to the incident manager, credentials reset, rule removed, bank details verified. The distinction changed the response, not just the label.
Traps
Treating every alert as an incident (alert fatigue), or every incident as IT-only. Calling a confirmed breach an event to avoid reporting. Classifying by cause instead of impact and urgency. Forgetting that severity can be re-evaluated as facts emerge.