Information Security Incident Management and Emergency Preparedness

The Norwegian ICT industry is far advanced in supporting ICT-based operations in various industries. For instance, the introduction of Integrated Operations (IO) in the petroleum industry has promoted accelerated production, increased oil recovery and red uced costs. However, being well prepared for emergencies and being able to handle ICT incidents are of the utmost importance to keep the industry internationally competitive and to stay in business. Common for all enterprises and industries working in th e setting of ICT-based operations is the continuous working day, where responsibilities for processes follow daylight around the globe. This means that ICT incidents will strike evenly independent of time of the day they occur, and the enterprise needs to be prepared and able to deal with incidents quickly in order to reduce consequences. One of the main challenges is technological support for incident management. The number of alerts during a month can easily be several thousands, which means that manua l follow-up is impossible. IMMER will improve the Norwegian industry's ability to foresee, detect and respond to incidents in ICT-based operations through developing new knowledge (theories, methods and tools) for information security incident management and emergency response, and implementing and testing of these results in enterprises within the petroleum, railway, air traffic control and telecom industries. IMMER aims at a proactive approach to incident management by focusing on early detection and h andling of information security incidents by automated monitoring and detection of information security incidents. The Norwegian government objective is to be world leading in health, environment and safety. IMMER should contribute to making Norway a wor ld leader in managing ICT incidents in ICT-based operations as well.