Learning from information security incidents

Information security incident management processes are meant to help the organization contain and recover more efficiently from incidents.  Well-designed processes also enable the organization to understand the risks that materialized, analyze and identify the root causes, and make improvements to the security controls in order to reduce the risk of further incidents.

The School of Hard Knocks is an effective but rather brutal institution.  We can certainly learn from the information security incidents we suffer directly, but they can be costly - devastating even.  The worst can literally threaten the organization’s survival.  Hard knocks indeed!  

The awareness materials this month extend the idea of learning from our own information security incidents to take in lessons from incidents affecting third parties.  The idea is to gain the knowledge without actually suffering the adverse impacts of information security failures. 

It’s obvious when you think about it, but does your organization do this systematically?