1

What are features of a suitable tool for tracking and reporting security incidents? Is it a bad idea to have one central repository for tracking all types of incidents, from helpdesk issues, to security attacks, failures, power outage, and downtime? Or it is better to use specific tools for tracking specific types of incidents?

Has anyone used Jira for the purpose of tracking security incidents such as malware, DDoS, data breach, and downtime?

closed as primarily opinion-based by M'vy, RoraΖ, Jens Erat, Xander, TildalWave Feb 20 '15 at 19:15

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • mitre.org/publications/all/… – atdre Jan 9 '15 at 20:59
  • you can customise jira workflow to do anything. yet i think that JCx is onto something to say to use something that people responding to the incidents already use. with big firms the devs use jira, so does devlops, but the production management and network support teams typically use another tool specifically marketed for tracking incident KPIs and escalations. jira is optimised for agile requirements. other tools do 'which systems are impacted by this change and who can approve the change?'. jira has a resetful api so you can integrate with other apps if those apps are too rigid. – simbo1905 Jan 11 '15 at 15:15
2

The best solution for security incidents is one that has all the people who might need to work on the incident already using it.

It's tempting (I've done it) to implement a separate security incident system. Fears about confidentiality of the allure of security specific features make it attractive.

But in the end if the organisation already has something with SLAs, tracking and most of all the ability to assign jobs to anyone to get stuff fixed that's worth a million dollars. Use it.

You also get some bonuses: not having to support another system, management reporting already in place, reusing existing training and documentation. There's lots of reasons not to implement something specifically for security.

(JIRA would work - but the most important thing is to use what your resolvers are using).

Not the answer you're looking for? Browse other questions tagged or ask your own question.