An information security event is an event that can affect the confidentiality, integrity, or availability of information. It’s like something unusual happening with your data that might be a security problem. This can be anything from a small error to a big security threat. The word “event” means something that happens, and “information security” means protecting your data.
Examples
- A login failure: Someone tries to log in with the wrong password too many times.
- Malware detected: Your computer finds a virus or other malicious software.
- Unusual network activity: There’s a lot of data being sent from a computer at an odd time.
- A lost or stolen laptop: A device with important data is missing.
Context
When a security event happens, an organisation needs to figure out if it’s a security incident. A security incident is an event that harms or threatens the security of an organisation’s data. Not all security events become incidents, but they all need to be looked at to be safe. For example, one login failure might just be a typo, but 100 login failures in a row could be a hacking attempt.
Relevant ISO 27001 Controls
The following ISO 27001 controls apply:
| Related ISO 27001 Control | Relationship Description |
|---|---|
| ISO 27001 Annex A 5.24: Incident Management Planning | Pre-emptive Step: Provides the framework for identifying and preparing for events that could potentially escalate into security incidents. |
| ISO 27001 Annex A 5.25: Assessment of Events | Core Process: The specific control that mandates assessing “Events” to determine if they should be classified as “Incidents.” |
| ISO 27001 Annex A 5.26: Response to Incidents | Escalation Path: If a security event is assessed and found to have a negative impact or pose a threat, it is managed through this incident response control. |
| ISO 27001 Annex A 8.15: Logging | Detection Tool: System logs are the primary technical source for discovering security events, such as failed logins or unusual network activity. |
| ISO 27001 Annex A 8.16: Monitoring Activities | Visibility: Active monitoring is required to identify “Events” in real-time before they can cause damage or become major incidents. |
| Glossary: Incident | Related Concept: An event is the occurrence of a state; it only becomes an “Incident” when it is confirmed to harm or threaten data security. |
| Glossary: CIA Triad | Security Impact: An event is categorized by its potential to affect the Confidentiality, Integrity, or Availability of information. |
| ISO 27001 Glossary of Terms (Main Index) | Parent Directory: The central index where Information Security Event is categorized as a fundamental incident management term. |
About the author
