What are features of a suitable tool for tracking and reporting security incidents? Is it a bad idea to have one central repository for tracking all types of incidents, from helpdesk issues, to security attacks, failures, power outage, and downtime? Or it is better to use specific tools for tracking specific types of incidents?
Has anyone used Jira for the purpose of tracking security incidents such as malware, DDoS, data breach, and downtime?
The best solution for security incidents is one that has all the people who might need to work on the incident already using it.
It's tempting (I've done it) to implement a separate security incident system. Fears about confidentiality of the allure of security specific features make it attractive.
But in the end if the organisation already has something with SLAs, tracking and most of all the ability to assign jobs to anyone to get stuff fixed that's worth a million dollars. Use it.
You also get some bonuses: not having to support another system, management reporting already in place, reusing existing training and documentation. There's lots of reasons not to implement something specifically for security.
(JIRA would work - but the most important thing is to use what your resolvers are using).
