ISO 27000 definition

It has been a long time.  I have been reading one of the articles from Rhand Leal and it is causing me concern.  Advisera is a good source but when your recommendations run counter to my advice to my customers I need try and fix that.

I know everyone has a different take on what security incidents and events are.  Rhand Leal’s article is very difficult to reconcile with my recommendations.

My definitions:

Security Events are events: Things that are logged by tools like Event Monitor on Windows:

Successful logins are events just like unsuccessful logins are, access to files are events, locking and unlocking a screen is an event.  In the analog-world leaving a laptop unattended would also be an event

When Rhand says that, an event has to be related to the possible failure of controls or “compromise of policies” is like saying that an incident is just a lot of events, or that all events are really junior incidents. I think that is really incorrect.  Events are the data upon which you can determine if controls are effective or not but events by themselves have no positive or negative connotations.  A door being opened with a LEGIC Card is an event, If the person with the card is not authorized then it is an incident.

A security incident I agree can be an event or group of events that indicate a compromise of business operations (Confidentiality, Availability, Integrity).  Example would be a door being opened with a valid key by an unauthorized person.

For me, non-compliance is something, which is not in accordance with a standard or policy.  Sometimes a non-compliance can actually identify an obsolete standard. Just an example would be the conflict between Password policies and the newest recommendations from NIST, (e.g. changing passwords every 90 days is no longer recommended procedure).

For me, the preferable category is “weakness”.  Usually, if not always, a valid non-compliance will identify a weakness.  A weakness being the state of affairs that promotes an incident. Examples of weaknesses would be missing patches. Another example would be insufficient Awareness trainings.  Basically, a weakness could be the lack of any relevant security control.

So with that could you (or Rhand) try and convince me that I am wrong or get Rhand to change or delete his post.

Thanks in advance.