GM1 IS.AR.215(b) Information security incidents -- detection, response and recovery

• ED Decision 2023/010/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)

GM1 IS.AR.215(b) Information security incidents — detection, response and recovery ED Decision 2023/010/R An attack is considered contained (i.e. it is not spreading any further) when the boundaries of the incident have been identified and the threat does not propagate beyond these boundaries. Further guidance can be found in EUROCAE ED-206  – Chapter 5. The term ‘warning’ as used in [IS.AR.215](#_DxCrossRefBm1193569462) should be understood as an alert that would require timely awareness and response from the information security events management team. In the context of information security response, ‘deception’ refers to a range of techniques that aim to mislead potential attackers or malicious users, thereby protecting the system and its data. Deception techniques, such as honeypots or breadcrumb trails, are designed to confuse, slow down, or divert attackers, increasing their cost and risk while providing defenders with valuable time and intelligence. Guidance regarding the vulnerability management strategy can be found in EUROCAE ED-206, Chapter 3.4 — Vulnerability management considerations. This is not the only source where guidance can be found, and the organisation may refer to different guidance more appropriate for their application. ##### GM1 IS.AR.215(b) Information security incidents — detection, response and recovery *ED Decision 2023/010/R* An attack is considered contained (i.e. it is not spreading any further) when the boundaries of the incident have been identified and the threat does not propagate beyond these boundaries. Further guidance can be found in EUROCAE ED-206 – Chapter 5. The term ‘warning’ as used in [IS.AR.215](#_DxCrossRefBm1749084196) should be understood as an alert that would require timely awareness and response from the information security events management team. In the context of information security response, ‘deception’ refers to a range of techniques that aim to mislead potential attackers or malicious users, thereby protecting the system and its data. Deception techniques, such as honeypots or breadcrumb trails, are designed to confuse, slow down, or divert attackers, increasing their cost and risk while providing defenders with valuable time and intelligence. Guidance regarding the vulnerability management strategy can be found in EUROCAE ED-206, Chapter 3.4 — Vulnerability management considerations. This is not the only source where guidance can be found, and the organisation may refer to different guidance more appropriate for their application.