Incident Classifications

[Wes Young <wcyoung () BUFFALO EDU>]

I'm in the process of overhauling our current incident handling system
that we've been running for a few years. I am at the point of revamping
how we classify incidents and the questions struck me... "will this
actually scale" and "at this point, do I actually care that it was
connecting to a botnet"?

In the past we've used things such as:

Spamming
Virus
DDos
Remote Compromise
Botnet

etc...


Coming purely from a network perspective, or even more so, a
risk-management based perspective, do I really care what the host was
doing while it was hosed? I'm more interested in classifying the risk of
the incident longer term. Maybe a little more description than "Severity
1, 2, etc...", but along the same lines.... Something that describes the
risk and makes it easy to tie to an easily perceptive value....

Does anyone know/have a commonly used framework for stuff like this?
--
Wes Young
Network Security Analyst
University at Buffalo
 -----------------------------------------------
| my OpenID:        | http://tinyurl.com/2zu2d3 |
 -----------------------------------------------

Today is currently under construction. Thank you for understanding.