ANSI INCITS ISO IEC TR 18044-2004 Information technology C Security techniques - Information security incident management (TECHNICAL REPORT).pdf

1、 INCITS/ISO/IEC TR 18044-2004 (ISO/IEC TR 18044:2004, IDT) Information technology Security techniques - Information security incident management (TECHNICAL REPORT) INCITS/ISO/IEC TR 18044-2004 PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, th

2、is file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobes licensing policy. The ISO Central Secret

3、ariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensu

4、re that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. Registered by INCITS (InterNational Committee for Information Technology Standards) as an American National Stand

5、ard. Date of Registration: 11/27/2005 Published by American National Standards Institute, 25 West 43rd Street, New York, New York 10036 Copyright 2005 by Information Technology Industry Council (ITI). All rights reserved. These materials are subject to copyright claims of International Standardizati

6、on Organization (ISO), International Electrotechnical Commission (IEC), American National Standards Institute (ANSI), and Information Technology Industry Council (ITI). Not for resale. No part of this publication may be reproduced in any form, including an electronic retrieval system, without the pr

7、ior written permission of ITI. All requests pertaining to this standard should be submitted to ITI, 1101 K Street NW, Suite 610, Washington DC 20005. Printed in the United States of America ii ITIC 2005 All rights reserved Reference numberISO/IEC TR 18044:2004(E)ISO/IEC 2004TECHNICAL REPORT ISO/IECT

8、R18044First edition2004-10-15Information technology Security techniques Information security incident management Technologies de linformation Techniques de scurit Gestion dincidents de scurit de linformation ISO/IEC TR 18044:2004(E) PDF disclaimer This PDF file may contain embedded typefaces. In acc

9、ordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobes

10、licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for pri

11、nting. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. ISO/IEC 2004 All rights reserved. Unless otherwise specified, no part of

12、this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-

13、1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in Switzerland ii ISO/IEC 2004 All rights reservedISO/IEC TR 18044:2004(E) ISO/IEC 2004 All rights reserved iiiContents Page Forewordv Introductionvi 1 Scope 1 2 Normative References. 1 3 Te

14、rms and Definitions 1 3.1 Business continuity planning 1 3.2 Information security event 2 3.3 Information security incident 2 3.4 ISIRT (Information Security Incident Response Team) 2 3.5 Other . 2 4 Background . 2 4.1 Objectives 2 4.2 Processes . 2 5 Benefits and Key Issues 5 5.1 Benefits . 5 5.2 K

15、ey Issues . 7 6 Examples of Information Security Incidents and their Causes. 11 6.1 Denial of Service. 11 6.2 Information Gathering. 12 6.3 Unauthorized Access. 13 7 Plan and Prepare. 13 7.1 Overview. 13 7.2 Information Security Incident Management Policy 14 7.3 Information Security Incident Managem

16、ent Scheme 16 7.4 Information Security and Risk Management Policies . 19 7.5 Establishment of the ISIRT. 20 7.6 Technical and Other Support. 21 7.7 Awareness and Training 22 8 Use 23 8.1 Introduction. 23 8.2 Overview of Key Processes. 24 8.3 Detection and Reporting . 26 8.4 Event/Incident Assessment

17、 and Decision 27 8.5 Responses 30 9 Review 36 9.1 Introduction. 36 9.2 Further Forensic Analysis . 36 9.3 Lessons Learnt 36 9.4 Identification of Security Improvements. 37 9.5 Identification of Scheme Improvements . 37 10 Improve 37 10.1 Introduction. 37 10.2 Security Risk Analysis and Management Im

18、provement . 37 10.3 Make Security Improvements . 38 ISO/IEC TR 18044:2004(E) iv ISO/IEC 2004 All rights reserved10.4 Make Scheme Improvements 38 10.5 Other Improvements 38 11 Summary 38 Annex A (informative) Example Information Security Event and Incident Report Forms .39 Annex B (informative) Examp

19、le Outline Guidelines for Assessing Information Security Incidents 46 Bibliography50 ISO/IEC TR 18044:2004(E) ISO/IEC 2004 All rights reserved vForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for wo

20、rldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate

21、 in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are d

22、rafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an In

23、ternational Standard requires approval by at least 75 % of the national bodies casting a vote. In exceptional circumstances, the joint technical committee may propose the publication of a Technical Report of one of the following types: type 1, when the required support cannot be obtained for the pub

24、lication of an International Standard, despite repeated efforts; type 2, when the subject is still under technical development or where for any other reason there is the future but not immediate possibility of an agreement on an International Standard; type 3, when the joint technical committee has

25、collected data of a different kind from that which is normally published as an International Standard (“state of the art”, for example). Technical Reports of types 1 and 2 are subject to review within three years of publication, to decide whether they can be transformed into International Standards.

26、 Technical Reports of type 3 do not necessarily have to be reviewed until the data they provide are considered to be no longer valid or useful. ISO/IEC TR 18044, which is a Technical Report of type 3, was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27

27、, IT Security techniques. ISO/IEC TR 18044:2004(E) vi ISO/IEC 2004 All rights reservedIntroduction No typical information security policies or safeguards will guarantee total protection of information, information systems, services or networks. After safeguards have been implemented, residual weakne

28、sses are likely to remain that may make information security ineffective and thus information security incidents possible, potentially with both direct and indirect adverse impacts on an organizations business operations. Further, inevitably new previously unidentified threats will occur. Insufficie

29、nt preparation by an organization to deal with such incidents will make any actual response less effective, and potentially increase the degree of potential adverse business impact. Therefore it is essential for any organization that is serious about information security to have a structured and pla

30、nned approach to: detect, report and assess information security incidents, respond to information security incidents, including by the activation of appropriate safeguards for the prevention and reduction of, and recovery from, impacts (for example in the support and business continuity planning ar

31、eas), learn from information security incidents, institute preventive safeguards, and, over time, make improvements to the overall approach to information security incident management. TECHNICAL REPORT ISO/IEC TR 18044:2004(E) ISO/IEC 2004 All rights reserved 1Information technology Security techniq

32、ues Information security incident management 1 Scope This Type 3 Technical Report (TR) provides advice and guidance on information security incident management for information security managers, and information system, service and network managers. This TR contains 11 clauses and is organized in the

33、 following manner. Clause 1 describes the scope and is followed by a list of references in Clause 2 and terms and definitions in Clause 3. Clause 4 provides some background to information security incident management, and that is followed by a summary of the benefits and key issues in Clause 5. Exam

34、ples of information security incidents and their causes are then provided in Clause 6. The planning and preparation for information security incident management, including document production, is then described in Clause 7. The operational use of the information security incident management scheme i

35、s described in Clause 8. The review phase of information security management, including the identification of lessons learnt and improvements to security and the information security incident management scheme, is described in Clause 9. The improvement phase, i.e. making identified improvements to s

36、ecurity and the information security incident management scheme, is described in Clause 10. Finally, the TR concludes with a short summary in Clause 11. Annex A contains example information security event and incident report forms, and Annex B contains some example outline guidelines for assessing t

37、he adverse consequences of information security incidents, for inclusion in the reporting forms. The Annexes are followed by the Bibliography. 2 Normative References The following referenced documents are indispensable for the application of this document. For dated references, only the edition cite

38、d applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 13335-1:2004, IT security techniques Management of information and communications technology security Part 1: Concepts and models for information and communications technology

39、 security management ISO/IEC 17799:2000, Information technology Code of practice for information security management 3 Terms and Definitions For the purposes of this document the terms and definitions given in ISO/IEC 13335-1, ISO/IEC 17799 and the following apply. 3.1 Business continuity planning B

40、usiness continuity planning is the process to ensure that recovery of operations will be assured should any unexpected or unwanted incident occur that is capable of negatively impacting the continuity of essential business functions and supporting elements. The process should also ensure that recove

41、ry is achieved in the required priorities and timescales, and subsequently all business functions and supporting elements will be recovered back to normal. The key elements of this process need to ensure that the necessary plans and facilities are put in place, and tested, and that they encompass in

42、formation, business processes, information systems and services, voice and data communications, people and physical facilities. ISO/IEC TR 18044:2004(E) 2 ISO/IEC 2004 All rights reserved3.2 Information security event An information security event is an identified occurrence of a system, service or

43、network state indicating a possible breach of information security policy or failure of safeguards, or a previously unknown situation that may be security relevant. 3.3 Information security incident An information security incident is indicated by a single or a series of unwanted or unexpected infor

44、mation security events that have a significant probability of compromising business operations and threatening information security. (Examples of information security incidents are shown in Clause 6.) 3.4 ISIRT (Information Security Incident Response Team) An ISIRT is a team of appropriately skilled

45、 and trusted members of the organization, which will handle information security incidents during their lifecycle. At times this team may be supplemented by external experts, for example from a recognized computer incident response team or Computer Emergency Response Team (CERT). 3.5 Other Also see

46、the definitions in ISO/IEC JTC1 SC27 SD6, Glossary. 4 Background 4.1 Objectives As a key part of any organizations overall information security strategy, it is essential to have in place a structured well-planned approach to the management of information security incidents. The objectives of this ap

47、proach are to ensure that: information security events can be detected and dealt with efficiently, in particular in identifying whether they need to be categorized as information security incidents or not, 1 identified information security incidents are assessed and responded to in the most appropri

48、ate and efficient manner, the adverse impacts of information security incidents on the organization and its business operations can be minimized by appropriate safeguards as part of the incident response, possibly in conjunction with relevant elements from a business continuity plan or plans, lesson

49、s can be quickly learnt from information security incidents and their management. This is to increase the chances of preventing future information security incidents occurring, improve the implementation and use of information security safeguards, and improve the overall information security incident management scheme. 4.2 Processes To achieve the objectives outlined in Clause 4.1, information security incident management