Which process works with incident management to ensure that security breaches are detected and logged?

A security breach is a type of security incident, often involving unauthorized access to services or data. The 'Information security management' practice is responsible for preventing and managing such incidents. A key component of this practice is 'access management,' which ensures that users are granted the right to use a service, but access is denied to unauthorized users. When a potential breach is detected, it is logged as a security incident. The 'Incident management' and 'Information security management' practices then work together to investigate and resolve it, with access management providing the policies and logs to identify the nature of the breach.

A. Change management: This practice (now 'change enablement' in ITIL 4) manages the lifecycle of changes to services, not the real-time detection and logging of security incidents.

B. Service level management: This practice focuses on setting, monitoring, and achieving agreed-upon service levels with customers, not on the operational task of detecting security breaches.

D. Continual service improvement: This practice (now 'continual improvement') aims to align services with changing business needs by identifying and implementing improvements, rather than managing active security incidents.

1. AXELOS

"ITIL® Foundation

ITIL 4 Edition" (2019):

Section 5.2.8

Information security management: "The purpose of the information security management practice is to protect the information needed by the organization to conduct its business. This includes understanding and managing risks to the confidentiality

integrity

and availability of information

as well as other aspects of information security such as authentication (ensuring someone is who they claim to be) and non-repudiation (ensuring someone can’t deny that they took an action)." This section establishes the practice's role in security

which includes managing access and responding to security incidents.

Section 5.2.5

Incident management: "The purpose of the incident management practice is to minimize the negative impact of incidents by restoring normal service operation as quickly as possible." It further clarifies that security-related incidents require special handling and are often escalated to a specialist team

which would be governed by the information security management practice. The interaction between these two practices is crucial for handling breaches.