What is ICIRT?
Whenever there is a major information/communication system incident, which may pose threat to the system/network security or services in respect of availability, integrity and confidentiality, the ICIRT may be mobilised. Situations like damage of computer systems due to fire, computer virus outbreak, and denial of access to the services, etc. are some of the examples.
The ICIRT is composed of members from ISW as depicted in the following chart. Being the Commander of the ICIRT, ACP IS declares the system incident and decides on critical matters such as system recovery, service resumption logistics, etc. Other members such as Deputy Commander CSM IT/CTE COMMS and SSP BSB assist him in handling the incident. After the declaration of the incident, IRMs will command and provide manpower of the ICICCC and co-ordinate internal and external parties for recovering the system. The IO will oversee information disseminated to the media while the IT & Comms Managers will arrange fixing the problems.
ICIRT drill will be conducted annually to allow various parties to practise the operation and flow in case of incident. The WTO HKMC drill conducted in October 2005 was proved to be effective in allowing members to practise simulated incidents.
So, if you find anything suspected to be an information or communication system incident, do report to our CHD. With their consolidated information from your reports, they can trigger actions of various parties and recover the damaged system in the earliest possible time.
Police will be alarmed when there is a crime. Fireman will be alarmed when there is a fire. Who will be alarmed when there is an information/communication security system problem in the Force? It is the IT and Communication System Incident Response Team (ICIRT) under ISW.
The Central Helpdesk (CHD) will make an initial assessment of the situation whenever you report any information/communication security problems to them. If the cases are found to be information/communication incidents, they will be brought to the attention of the managers and then to the HICOM ICIRT. This ICIRT will take up the role of co-ordination, communication and mobilisation of resources to deal with the incident.