BS ISO IEC 27010-2015 Information technology Security techniques Information security management for inter-sector and inter-organizational communications《信息技术 安全技术 部门间和组织间通信用信息安全管理.pdf

1、BSI Standards PublicationBS ISO/IEC 27010:2015Information technology Security techniques Information securitymanagement for inter-sectorand inter-organizationalcommunicationsBS ISO/IEC 27010:2015 BRITISH STANDARDNational forewordThis British Standard is the UK implementation of ISO/IEC 27010:2015. I

2、t supersedes BS ISO/IEC 27010:2012 which is withdrawn.The UK participation in its preparation was entrusted to TechnicalCommittee IST/33/1, Information Security Management Systems.A list of organizations represented on this committee can beobtained on request to its secretary.This publication does n

3、ot purport to include all the necessaryprovisions of a contract. Users are responsible for its correctapplication. The British Standards Institution 2015.Published by BSI Standards Limited 2015ISBN 978 0 580 89580 7ICS 35.040Compliance with a British Standard cannot confer immunity fromlegal obligat

4、ions.This British Standard was published under the authority of theStandards Policy and Strategy Committee on 30 November 2015.Amendments/corrigenda issued since publicationDate T e x t a f f e c t e dBS ISO/IEC 27010:2015Information technology Security techniques Information security management for

5、 inter-sector and inter-organizational communicationsTechnologies de linformation Techniques de scurit Gestion de la scurit de linformation des communications intersectorielles et interorganisationnellesINTERNATIONAL STANDARDISO/IEC27010Reference numberISO/IEC 27010:2015(E)Second edition2015-11-15 I

6、SO/IEC 2015BS ISO/IEC 27010:2015ii ISO/IEC 2015 All rights reservedCOPYRIGHT PROTECTED DOCUMENT ISO/IEC 2015, Published in SwitzerlandAll rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechan

7、ical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester.ISO copyright officeCh. de Blandonnet 8 CP 401CH-1214 Vernier, Geneva, Switz

8、erlandTel. +41 22 749 01 11Fax +41 22 749 09 47copyrightiso.orgwww.iso.orgISO/IEC 27010:2015(E)BS ISO/IEC 27010:2015ISO/IEC 27010:2015(E)Foreword viIntroduction vii1 Scope . 12 Normative references 13 Terms and definitions . 14 Concepts and justification 14.1 Introduction 14.2 Information sharing co

9、mmunities . 24.3 Community management 24.4 Supporting entities 24.5 Inter-sector communication . 24.6 Conformity 34.7 Communications model 45 Information security policies 45.1 Management direction for information security . 45.1.1 Policies for information security 45.1.2 Review of the policies for

10、information security 56 Organization of information security . 57 Human resource security 57.1 Prior to employment 57.1.1 Screening 57.1.2 Terms and conditions of employment . 57.2 During employment 57.3 Termination and change of employment . 58 Asset management . 58.1 Responsibility for assets . 58

11、.1.1 Inventory of assets . 58.1.2 Ownership of assets 58.1.3 Acceptable use of assets 68.1.4 Return of assets 68.2 Information classification 68.2.1 Classification of information . 68.2.2 Labelling of information 68.2.3 Handling of assets . 68.3 Media handling . 68.4 Information exchanges protection

12、 . 78.4.1 Information dissemination . 78.4.2 Information disclaimers 78.4.3 Information credibility . 78.4.4 Information sensitivity reduction . 88.4.5 Anonymous source protection . 88.4.6 Anonymous recipient protection . 88.4.7 Onwards release authority 99 Access control 910 Cryptography 910.1 Cryp

13、tographic controls 910.1.1 Policy on the use of cryptographic controls . 910.1.2 Key management . 911 Physical and environmental security 9 ISO/IEC 2015 All rights reserved iiiContents PageBS ISO/IEC 27010:2015ISO/IEC 27010:2015(E)12 Operations security . 912.1 Operational procedures and responsibil

14、ities . 912.2 Protection from malware 1012.2.1 Controls against malware 1012.3 Backup . 1012.4 Logging and monitoring . 1012.4.1 Event logging 1012.4.2 Protection of log information . 1012.4.3 Administrator and operator logs 1012.4.4 Clock synchronization 1012.5 Control of operational software 1012.

15、6 Technical vulnerability management . 1012.7 Information systems audit considerations 1012.7.1 Information systems audit controls . 1012.7.2 Community audit rights 1013 Communications security 1113.1 Network security management . 1113.2 Information transfer . 1113.2.1 Information transfer policies

16、and procedures 1113.2.2 Agreements on information transfer 1113.2.3 Electronic messaging 1113.2.4 Confidentiality or non-disclosure agreements .1114 System acquisition, development and maintenance 1115 Supplier relationships .1215.1 Information security in supplier relationships 1215.1.1 Information

17、 security policy for supplier relationships .1215.1.2 Addressing security within supplier agreements 1215.1.3 Information and communication technology supply chain .1215.2 Supplier service delivery management 1216 Information security incident management 1216.1 Management of information security inc

18、idents and improvements .1216.1.1 Responsibilities and procedures . 1216.1.2 Reporting information security events .1216.1.3 Reporting information security weaknesses 1316.1.4 Assessment of, and decision on, information security events .1316.1.5 Response to information security incidents .1316.1.6 L

19、earning from information security incidents 1316.1.7 Collection of evidence .1316.1.8 Early warning system .1317 Information security aspects of business continuity management .1317.1 Information security continuity 1317.1.1 Planning information security continuity .1317.1.2 Implementing information

20、 security continuity .1417.1.3 Verify, review and evaluate information security continuity .1417.2 Redundancies 1418 Compliance 1418.1 Compliance with legal and contractual requirements .1418.1.1 Identification of applicable legislation and contractual requirements 1418.1.2 Intellectual property rig

21、hts . 1418.1.3 Protection of records .1418.1.4 Privacy and protection of personally identifiable information 1418.1.5 Regulation of cryptographic controls .1418.1.6 Liability to the information sharing community .1418.2 Information security reviews 15Annex A (informative) Sharing sensitive informati

22、on 16iv ISO/IEC 2015 All rights reservedBS ISO/IEC 27010:2015ISO/IEC 27010:2015(E)Annex B (informative) Establishing trust in information exchanges 21Annex C (informative) The Traffic Light Protocol 25Annex D (informative) Models for organizing an information sharing community 26Bibliography .32 ISO

23、/IEC 2015 All rights reserved vBS ISO/IEC 27010:2015ISO/IEC 27010:2015(E)ForewordISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC

24、participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, govern

25、mental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.The procedures used to develop this document and those intended for its further maintenance are descri

26、bed in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).Attention is drawn to the p

27、ossibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the

28、 ISO list of patent declarations received (see www.iso.org/patents).Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment,

29、as well as information about ISOs adherence to the WTO principles in the Technical Barriers to Trade (TBT) see the following URL: Foreword - Supplementary informationThe committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT Security techniques.This second editio

30、n cancels and replaces the first edition (ISO/IEC 27010:2012), which has been revised for compatibility with ISO/IEC 27001:2013 and ISO/IEC 27002:2013.vi ISO/IEC 2015 All rights reservedBS ISO/IEC 27010:2015ISO/IEC 27010:2015(E)IntroductionThis International Standard is a sector-specific supplement

31、to ISO/IEC 27001:2013 and ISO/IEC 27002:2013 for use by information sharing communities. The guidelines contained within this International Standard are in addition to, and complement, the generic guidance given within other members of the ISO/IEC 27000 family of standards.ISO/IEC 27001:2013 and ISO

32、/IEC 27002:2013 address information exchange between organizations, but they do so in a generic manner. When organizations wish to communicate sensitive information to multiple other organizations, the originator must have confidence that its use in those other organizations will be subject to adequ

33、ate security controls implemented by the receiving organizations. This can be achieved through the establishment of an information sharing community, where each member trusts the other members to protect the shared information, even though the organizations may otherwise be in competition with each

34、other.An information sharing community cannot work without trust. Those providing information must be able to trust the recipients not to disclose or to act upon the data inappropriately. Those receiving information must be able to trust that information is accurate, subject to any qualifications no

35、tified by the originator. Both aspects are important, and must be supported by demonstrably effective security policies and the use of good practice. To achieve this, the community members must all implement a common management system covering the security of the shared information. This is an infor

36、mation security management system (ISMS) for the information sharing community.In addition, information sharing can take place between information sharing communities where not all recipients will be known to the originator. This will only work if there is adequate trust between the communities and

37、their information sharing agreements. It is particularly relevant to the sharing of sensitive information between diverse communities, such as different industry or market sectors. ISO/IEC 2015 All rights reserved viiBS ISO/IEC 27010:2015BS ISO/IEC 27010:2015Information technology Security technique

38、s Information security management for inter-sector and inter-organizational communications1 ScopeThis International Standard provides guidelines in addition to the guidance given in the ISO/IEC 27000 family of standards for implementing information security management within information sharing comm

39、unities.This International Standard provides controls and guidance specifically relating to initiating, implementing, maintaining, and improving information security in inter-organizational and inter-sector communications. It provides guidelines and general principles on how the specified requiremen

40、ts can be met using established messaging and other technical methods.This International Standard is applicable to all forms of exchange and sharing of sensitive information, both public and private, nationally and internationally, within the same industry or market sector or between sectors. In par

41、ticular, it may be applicable to information exchanges and sharing relating to the provision, maintenance and protection of an organizations or nation states critical infrastructure. It is designed to support the creation of trust when exchanging and sharing sensitive information, thereby encouragin

42、g the international growth of information sharing communities.2 Normative referencesThe following documents, in whole or in part, are normatively referenced in this document and are indispensable for its application. For dated references, only the edition cited applies. For undated references, the l

43、atest edition of the referenced document (including any amendments) applies.ISO/IEC 27000:2014, Information technology Security techniques Information security management systems Overview and vocabularyISO/IEC 27001:2013, Information technology Security techniques Information security management sys

44、tems RequirementsISO/IEC 27002:2013, Information technology Security techniques Code of practice for information security controls3 Terms and definitionsFor the purposes of this document, the terms and definitions in ISO/IEC 27000:2014 apply.4 Concepts and justification4.1 IntroductionISMS guidance

45、specific to inter-sector and inter-organizational communications has been identified in Clauses 5 to 18 of this International Standard.ISO/IEC 27002:2013 defines controls that cover the exchange of information between organizations on a bilateral basis, and also controls for the general distribution

46、 of publicly available information. However, in some circumstances there exists a need to share information within a community of organizations where the information is sensitive in some way and cannot be made publicly available other than to INTERNATIONAL STANDARD ISO/IEC 27010:2015(E) ISO/IEC 2015

47、 All rights reserved 1BS ISO/IEC 27010:2015ISO/IEC 27010:2015(E)members of the community. Often the information can only be made available to certain individuals within each member organization, or may have other security requirements such as anonymization of information. This International Standard

48、 defines additional potential controls and provides additional guidance and interpretation of ISO/IEC 27001:2013 and ISO/IEC 27002:2013 in order to meet these requirements.There are four informative annexes. Annex A describes the potential benefits from sharing sensitive information between organiza

49、tions. Annex B provides guidance on how members of an information sharing community can assess the degree of trust that can be placed in information provided by other members. Annex C describes the Traffic Light Protocol, a mechanism widely used in information sharing communities to indicate the permitted distribution of information. Annex D contains some examples of models for organizing an information sharing community.4.2 Information sharing communitiesTo be effective, information sharing communities must have some common