Device Class 1: Incident Reporting

Control ID: IR-6 Incident Reporting Family: Incident Response Source: NIST 800-53r4
Control: The organization:
  1. Requires personnel to report suspected security incidents to the organizational incident response capability within [Assignment: organization-defined time period]; and
  2. Reports security incident information to [Assignment: organization-defined authorities].
Supplemental Guidance:
The intent of this control is to address both specific incident reporting requirements within an organization and the formal incident reporting requirements for federal agencies and their subordinate organizations. Suspected security incidents include, for example, the receipt of suspicious email communications that can potentially contain malicious code. The types of security incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable state and federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Current federal policy requires that all federal agencies (unless specifically exempted from such requirements) report security incidents to the United States Computer Emergency Readiness Team (US-CERT) within specified time frames designated in the US-CERT Concept of Operations for Federal Cyber Security Incident Handling.
NOTE 1: In the C-ITS setting, there is a concept of a "misbehavior authority" (MA) that is responsible for detecting potentially malicious behavior within the setting of specific applications, e.g. crash avoidance via BSMs. For those applications, "misbehavior reports" (the term of art for incident reports in this context) are provided to the misbehavior authority rather than to CERT.
NOTE 2: There are no device-level mechanisms associated with this non-enhanced security control. The device-level mechanisms are associated with control enhancement (1) below.

Related Controls: IR-4, IR-5, IR-8
Control Enhancements:
(1) Incident Reporting | Automated Reporting
The organization employs automated mechanisms to assist in the reporting of security incidents.
Supplemental Guidance:
Related Controls: IR-7
References: NIST Special Publication 800-61; Web: http://www.us-cert.gov.
Mechanisms:

ASSUMPTION: There are two different classes of incident: incidents that are common to any networked device, which are handled by non-application-specific mechanisms within the device and are referred to below as "system-level incidents"; and incidents that are specific to activity within a specific C-ITS application, which are detected by application-specific mechanisms and are referred to below as "application-level incidents".

  • System-level incidents
    • The device shall provide audit report generation functionality as described in AU-1 to AU-12
    • The device shall be configurable to automatically send incident reports based on the generated audit reports to an incident response authority under given conditions.
    • The device shall ensure that the conditions under which these incident reports are sent, and the identification and network location information associated with the incident response authority, shall only be editable by a privileged user.
  • Application-level incidents
    • The application specification shall contain performance requirements related to misbehavior reporting, for example:
      • Amount of storage necessary
      • How long un-transmitted reports should be stored for
      • Preservation or deletion of transmitted reports
      • Prioritization of reports for preservation if the reports would exceed the allocated storage .
      • How reports are to be prioritized for transmission to the misbehavior authority (MA) when connectivity is available
    • If misbehavior is defined for an application, the application shall support detecting that misbehavior.
    • The security management services shall support receiving misbehavior report payloads and misbehavior reporting configuration information from an application, and shall support prioritizing which misbehavior reports to send.
    • The device shall support transmitting misbehavior reports to a misbehavior authority.
    • The device shall ensure that the conditions under which these incident reports are sent, and the identification and network location information associated with the incident response authority, shall only be editable by a privileged user.
(Assumption: The application specification identifies misbehavior within the context of application activity; for certain applications it is possible that defining misbehavior is not necessary)

Protocol Implementation Conformance Statements:
ID Statement Status Reference Notes
IR-6(1)/1 Support audit logging as specified in FAMILY: AUDIT AND ACCOUNTABILITY M
IR-6(1)/2 Support automatic sending of incident reports to an incident response authority under given conditions M
IR-6(1)/3 Support edit of incident report only by privileged user M
IR-6(1)/4 Application specification contain performance requirements related to misbehavior reporting M
IR-6(1)/5 Support misbehavior detection as defined for that application O
IR-6(1)/6 Security management services support receiving misbehavior report payloads and misbehavior reporting configuration information from an application M
IR-6(1)-7 Security management services support prioritization of misbehavior reports to send O
IR-6(1)/8 Support transmitting misbehavior reports to a misbehavior authority M
IR-6(1)/9 Support edit of incident report only by privileged user M