Ruslan Rakhmetov, Security Vision
When a cyber incident occurs, it's important to assess its type and severity to prioritize response measures. In large companies, information security incidents can occur on a massive scale, so it's essential to define a process for handling them based on their characteristics and potential consequences. Cyber incident response plans should include not only a sequence of actions but also the criteria by which an attack is classified. In this article, we will look at how to correctly classify information security incidents by severity and type.
First, let's review some terminology. According to the ISO 27000 standard, an information security event is a specific state of a system, service, or network that indicates a probable violation of an information security policy, a failure of security measures, or a previously unknown situation that may be related to information security. In other words, an information security event is a change in the state of IT infrastructure elements that may indicate the occurrence of an information security incident. The same standard defines an information security incident as one or more unwanted or unexpected information security events that, with a significant probability, indicate a compromise of business processes or a realized information security threat. In other words, a cyber incident is an information security event that leads to the realization of an information security threat, i.e., an unauthorized change to the security status of information (confidentiality, integrity, availability). As we wrote in one of our previous articles, a cyber threat arises when there is a threat source, a vulnerability (system, asset, or information security system), a method of implementing the threat, an object of influence, the malicious influence itself, and its consequences.
Thus, an incident will be characterized by the properties of the realized threat, the characteristics of the attacked asset, the category (type) and cause of the incident, the consequences (predicted damage) to the protected assets, and the incident priority level, which depends on the estimated consequences. The following logical chain can be constructed:
Potential Threat -> Event -> Incident -> Realized Threat
Incident classification can be based on the frameworks, methodology, and response process management standards used. For example, for critical information infrastructure entities, the Order of the National Coordination Center for Computer Incidents of July 14, 2026, No. 2, "On improving the activities for organizing interaction between the National Coordination Center for Computer Incidents and critical information infrastructure entities, GosSOPKA centers, and agencies (organizations)" applies. This Order, as well as all regulatory legal acts related to the protection of critical information infrastructure, provides for demarcation between the terms "computer attacks" and "computer incidents":
-
A computer attack is a targeted impact of software and/or hardware on critical information infrastructure facilities, telecommunication networks used to organize the interaction of such facilities, with the aim of disrupting and/or terminating their functioning and/or creating a threat to the security of the information processed by such facilities.
-
A computer incident is an incident of disruption and/or termination of the functioning of a critical information infrastructure facility, a telecommunications network used to organize the interaction of such facilities, and/or a breach of the security of information processed by such a facility, including one that occurs as a result of a computer attack.
Thus, a computer attack is a targeted malicious action, and a computer incident can be caused by both an attack and technological disruptions, errors, or failures.
The said order lists the following types of computer attacks (to determine the type of attack, the NKTsKI has developed corresponding methodological recommendations):
-
DDoS attack
-
Failed authorization attempts
-
Attempts to introduce malicious software (malware)
-
Attempts to exploit the vulnerability
-
Publishing fraudulent information
-
Network scanning
-
Social engineering
The same order lists the following types of computer incidents:
-
Using a controlled resource to carry out attacks
-
Slowdown of resource operation as a result of a DDoS attack
-
Infection with malware
-
Network traffic capture
-
Account compromise
-
Unauthorized change of information
-
Unauthorized disclosure of information
-
Publication of information prohibited by Russian legislation on the resource
-
The event is not related to a computer attack.
-
Successful exploitation of a vulnerability
The Bank of Russia Standard STO BR BFBO-1.5-2023, "Security of Financial (Banking) Operations. Management of Incidents Related to the Implementation of Information Threats and Incidents of Operational Reliability," is in effect in the banking sector. Appendix 11 of this standard provides a list of types of information security incidents and operational reliability incidents. Appendix 18 of this standard provides the following list of computer incidents and computer attacks:
-
Slowdown of resource operation as a result of a denial of service attack
-
Successful exploitation of a vulnerability
-
Infection with malware
-
Account compromise
-
Publication of information prohibited by Russian legislation on a controlled resource
-
Network traffic capture
-
Unauthorized change of information
-
Unauthorized disclosure of information
-
Using a controlled resource to carry out attacks
-
An incident not related to a computer attack
-
Social engineering
-
Changing (substituting) the mobile subscriber identifier (IMSI), mobile equipment identifier (IMEI) or SIM card
Another incident taxonomy scheme has been developed by the EU Agency for Cybersecurity (ENISA) and is set out in the document "Reference Incident Classification Taxonomy" ("Reference Classification of Incidents"). It lists the following types of incidents:
-
Malicious content
-
Malicious code
-
Information collection
-
Invasion attempts
-
Invasions
-
Attacks on information availability
-
Unauthorized access or alteration of information
-
Fraud
-
Other types of attacks
The authors of the VERIS framework (Vocabulary for Event Recording and Incident Sharing) suggests filling out a description with the following properties for each incident:
1) Attackers (actors): external attackers, internal attackers (insiders), partners (third parties – suppliers, vendors, providers, outsourcers, etc.);
2) Malicious actions: malware (viruses, worms, keyloggers, backdoors, etc.), hacking (targeted unauthorized access by bypassing security mechanisms), social engineering, misuse, physical attack, error (glitch), environmental impact.
3) Compromised assets: their number, owners, administrators (responsible persons), location (internal or external infrastructure, dedicated environment, shared storage/hosting, etc.), asset availability after the incident (only accessible from inside, only from outside, isolated, etc.), impact of cloud infrastructure on the incident (hypervisor hack, attack on hosting provider, incorrect hosting configuration, etc.), notes.
4) Attributes (security properties) of the asset that were compromised (violated): confidentiality/asset ownership, integrity/authenticity, availability/readiness for use.
IN in accordance with ISO /IEC 27035-1:2023 "Information security incident management. Part 1: Principles and process" the following scheme for describing cyber incidents can be proposed:
1) Cause: intentional incident (targeted impact), accidental incident, software failure/technical error, environmental impact (natural phenomena, anthropogenic and man-made factors);
2) Methods: technical (malware, exploitation of unprotected configurations, equipment failure), non-technical (physical impact, loss of media or devices) or a combination of both;
3) Impact (consequences): unauthorized disclosure of information, unauthorized modification of information, destruction of information, unavailability of information, theft or other damage to corporate assets containing information.
In addition, the appendix to the ISO/IEC 27035-1:2023 standard provides the following examples of types of cyber incidents: DoS attacks, unauthorized access, malware, violation of information security policies, information gathering.
Based on the information listed above, the following approximate classification scheme for incidents by severity and type can be proposed:
It should be noted that when building cyber incident response processes, it is important not only to be guided by applicable legal requirements and proven frameworks, but also to fine-tune playbooks to the specific characteristics and context of a specific organization. This is why the table above is only a generalized example – in real-world use, it is necessary to consider the threat and attacker model, the results of cyber risk analysis, the specific IT infrastructure and business processes, the organizational structure, and even the established relationships between departments. To automate information security incident response processes, the Security Vision solution portfolio includes Security Vision SOAR and NG SOAR, which enable the classification and prioritization of cyber incidents based on all the characteristics of the attacked asset, affected entities, and infrastructure features, and also enable the use of dynamic playbooks that adapt to the context of a specific incident. Additionally, Security Vision solutions such as Security Vision SIEM, Security Vision TIP, Security Vision UEBA, Security Vision AM / CMDB can be used to automate cyber incident response.
