CAN CSA-ISO IEC 27035-2013 Information technology - Security techniques - Information security Incident management.pdf

1、Information technology Security techniques Information security incident managementCAN/CSA-ISO/IEC 27035:13(ISO/IEC 27035:2011, IDT)National Standard of CanadaNOT FOR RESALE. / PUBLICATION NON DESTINE LA REVENTE.Legal Notice for StandardsCanadian Standards Association (operating as “CSA Group”) deve

2、lops standards through a consensus standards development process approved by the Standards Council of Canada. This process brings together volunteers representing varied viewpoints and interests to achieve consensus and develop a standard. Although CSA Group administers the process and establishes r

3、ules to promote fairness in achieving consensus, it does not independently test, evaluate, or verify the content of standards.Disclaimer and exclusion of liabilityThis document is provided without any representations, warranties, or conditions of any kind, express or implied, including, without limi

4、tation, implied warranties or conditions concerning this documents fitness for a particular purpose or use, its merchantability, or its non-infringement of any third partys intellectual property rights. CSA Group does not warrant the accuracy, completeness, or currency of any of the information publ

5、ished in this document. CSA Group makes no representations or warranties regarding this documents compliance with any applicable statute, rule, or regulation. IN NO EVENT SHALL CSA GROUP, ITS VOLUNTEERS, MEMBERS, SUBSIDIARIES, OR AFFILIATED COMPANIES, OR THEIR EMPLOYEES, DIRECTORS, OR OFFICERS, BE L

6、IABLE FOR ANY DIRECT, INDIRECT, OR INCIDENTAL DAMAGES, INJURY, LOSS, COSTS, OR EXPENSES, HOWSOEVER CAUSED, INCLUDING BUT NOT LIMITED TO SPECIAL OR CONSEQUENTIAL DAMAGES, LOST REVENUE, BUSINESS INTERRUPTION, LOST OR DAMAGED DATA, OR ANY OTHER COMMERCIAL OR ECONOMIC LOSS, WHETHER BASED IN CONTRACT, TO

7、RT (INCLUDING NEGLIGENCE), OR ANY OTHER THEORY OF LIABILITY, ARISING OUT OF OR RESULTING FROM ACCESS TO OR POSSESSION OR USE OF THIS DOCUMENT, EVEN IF CSA GROUP HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, INJURY, LOSS, COSTS, OR EXPENSES.In publishing and making this document available, CSA

8、 Group is not undertaking to render professional or other services for or on behalf of any person or entity or to perform any duty owed by any person or entity to another person or entity. The information in this document is directed to those who have the appropriate degree of experience to use and

9、apply its contents, and CSA Group accepts no responsibility whatsoever arising in any way from any and all use of or reliance on the information contained in this document. CSA Group is a private not-for-profit company that publishes voluntary standards and related documents. CSA Group has no power,

10、 nor does it undertake, to enforce compliance with the contents of the standards or other documents it publishes. Intellectual property rights and ownershipAs between CSA Group and the users of this document (whether it be in printed or electronic form), CSA Group is the owner, or the authorized lic

11、ensee, of all works contained herein that are protected by copyright, all trade-marks (except as otherwise noted to the contrary), and all inventions and trade secrets that may be contained in this document, whether or not such inventions and trade secrets are protected by patents and applications f

12、or patents. Without limitation, the unauthorized use, modification, copying, or disclosure of this document may violate laws that protect CSA Groups and/or others intellectual property and may give rise to a right in CSA Group and/or others to seek legal redress for such use, modification, copying,

13、or disclosure. To the extent permitted by licence or by law, CSA Group reserves all intellectual property rights in this document.Patent rightsAttention is drawn to the possibility that some of the elements of this standard may be the subject of patent rights. CSA Group shall not be held responsible

14、 for identifying any or all such patent rights. Users of this standard are expressly advised that determination of the validity of any such patent rights is entirely their own responsibility.Authorized use of this documentThis document is being provided by CSA Group for informational and non-commerc

15、ial use only. The user of this document is authorized to do only the following:If this document is in electronic form:sLOADTHISDOCUMENTONTOACOMPUTERFORTHESOLEPURPOSEOFREVIEWINGITsSEARCHANDBROWSETHISDOCUMENTANDsPRINTTHISDOCUMENTIFITISIN0$ this remains the continuing responsibility of the SDO. An NSC

16、reflects a consensus of a number of capable individuals whose collective interests provide, to the greatest practicable extent, a balance of representation of general interests, producers, regulators, users (including consumers), and others with relevant interests, as may be appropriate to the subje

17、ct in hand. It normally is a standard which is capable of making a significant and timely contribution to the national interest.Those who have a need to apply standards areencouraged to use NSCs. These standards are subjectto periodic review. Users of NSCs are cautionedto obtain the latest edition f

18、rom the SDO which publishes the standard.The responsibility for approving standards as National Standards of Canada rests with theStandards Council of Canada270 Albert Street, Suite 200Ottawa, Ontario, K1P 6N7CanadaAlthough the intended primary application of this Standard is stated in its Scope, it

19、 is importantto note that it remains the responsibility of the users to judge its suitability for their particular purpose.Registered trade-mark of Canadian Standards AssociationCette norme est offerte en anglais seulement pour le moment. Le Groupe CSA publiera la versionen franais ds quelle sera pr

20、oduite par lorganisme rdacteur.TMA trade-mark of the Canadian Standards Association, operating as “CSA Group”National Standard of CanadaPublished in January 2013 by CSA GroupA not-for-profit private sector organization5060 Spectrum Way, Suite 100, Mississauga, Ontario, Canada L4W 5N61-800-463-6727 4

21、16-747-4044Visit our Online Store at shop.csa.caApproved byStandards Council of CanadaCAN/CSA-ISO/IEC 27035:13Information technology Security techniques Information security incident managementPrepared by InternationalOrganizationforStandardization/ International Electrotechnical CommissionReviewed

22、byCAN/CSA-ISO/IEC 27035:13Information technology Security techniques Information security incident managementCSA/4 2013 CSA Group January 2013CAN/CSA-ISO/IEC 27035:13Information technology Security techniques Information security incident managementCSA PrefaceStandards development within the Informa

23、tion Technology sector is harmonized with international standards development. Through the CSA Technical Committee on Information Technology (TCIT), Canadians serve as the Canadian Advisory Committee (CAC) on ISO/IEC Joint Technical Committee 1 on Information Technology (ISO/IEC JTC1) for the Standa

24、rds Council of Canada (SCC), the ISO member body for Canada and sponsor of the Canadian National Committee of the IEC. Also, as a member of the International Telecommunication Union (ITU), Canada participates in the International Telegraph and Telephone Consultative Committee (ITU-T).This Standard r

25、eplaces CAN/CSA-ISO/IEC TR 18044-05 (adoption of ISO/IEC TR 18044:2004).At the time of publication, ISO/IEC 27035:2011 is available from ISO and IEC in English only. CSA Group will publish the French version when it becomes available from ISO and IEC.This International Standard was reviewed by the T

26、CIT under the jurisdiction of the Strategic Steering Committee on Information Technology and deemed acceptable for use in Canada. From time to time, ISO/IEC may publish addenda, corrigenda, etc. The TCIT will review these documents for approval and publication. For a listing, refer to the Current St

27、andards Activities page at standardsactivities.csa.ca. This Standard has been formally approved, without modification, by the Technical Committee and has been approved as a National Standard of Canada by the Standards Council of Canada. 2013 CSA GroupAll rights reserved. No part of this publication

28、may be reproduced in any form whatsoever without the prior permission of thepublisher. ISO/IEC material is reprinted with permission. Where the words “this International Standard “ appear in the text, they should be interpreted as “this National Standard of Canada”.Inquiries regarding this National

29、Standard of Canada should be addressed toCSA Group5060 Spectrum Way, Suite 100, Mississauga, Ontario, Canada L4W 5N61-800-463-6727 416-747-4000http:/csa.caTo purchase standards and related publications, visit our Online Store at shop.csa.ca or call toll-free 1-800-463-6727 or 416-747-4044.This Stand

30、ard is subject to periodic review, and suggestions for its improvement will be referred to the appropriate committee. To submit a proposal for change, please send the following information to inquiriescsagroup.org and include “Proposal for change” in the subject line:(a) Standard designation (number

31、);(b) relevant clause, table, and/or figure number;(c) wording of the proposed change; and(d) rationale for the change.Reference numberISO/IEC 27035:2011(E)ISO/IEC 2011INTERNATIONAL STANDARD ISO/IEC27035First edition2011-09-01Information technology Security techniques Information security incident m

32、anagement Technologies de linformation Techniques de scurit Gestion des incidents de scurit de linformation ISO/IEC 27035:2011(E) COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2011 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any

33、 means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail c

34、opyrightiso.org Web www.iso.org ii ISO/IEC 2011 All rights reservedCAN/CSA-ISO/IEC 27035:13ISO/IEC 27035:2011(E) ISO/IEC 2011 All rights reserved iiiContents Page Foreword . v Introduction vi 1 Scope 1 2 Normative references 1 3 Terms and definitions . 1 4 Overview . 2 4.1 Basic concepts 2 4.2 Objec

35、tives 3 4.3 Benefits of a structured approach . 4 4.4 Adaptability 5 4.5 Phases 6 4.6 Examples of information security incidents . 7 5 Plan and prepare phase 8 5.1 Overview of key activities . 8 5.2 Information security incident management policy 10 5.3 Information security incident management integ

36、ration in other policies . 12 5.4 Information security incident management scheme . 13 5.5 Establishment of the ISIRT . 18 5.6 Technical and other support (including operational support) 19 5.7 Awareness and training 20 5.8 Scheme testing 22 6 Detection and reporting phase 22 6.1 Overview of key act

37、ivities . 22 6.2 Event detection 25 6.3 Event reporting 25 7 Assessment and decision phase . 26 7.1 Overview of key activities . 26 7.2 Assessment and initial decision by the PoC 28 7.3 Assessment and incident confirmation by the ISIRT 30 8 Responses phase 31 8.1 Overview of key activities . 31 8.2

38、Responses . 32 9 Lessons learnt phase 40 9.1 Overview of key activities . 40 9.2 Further information security forensic analysis 40 9.3 Identifying the lessons learnt . 41 9.4 Identifying and making improvements to information security control implementation 42 9.5 Identifying and making improvements

39、 to information security risk assessment and management review results . 42 9.6 Identifying and making improvements to the information security incident management scheme . 42 9.7 Other improvements . 43 Annex A (informative) Cross reference table of ISO/IEC 27001 vs ISO/IEC 27035 . 44 Annex B (info

40、rmative) Examples of information security incidents and their causes 47 Annex C (informative) Example approaches to the categorization and classification of information security events and incidents 50 CAN/CSA-ISO/IEC 27035:13ISO/IEC 27035:2011(E) iv ISO/IEC 2011 All rights reservedAnnex D (informat

41、ive) Example information security event, yncident and vulnerability reports and forms 62 Annex E (informative) Legal and regulatory aspects 74 Bibliography 76 CAN/CSA-ISO/IEC 27035:13ISO/IEC 27035:2011(E) ISO/IEC 2011 All rights reserved vForeword ISO (the International Organization for Standardizat

42、ion) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to

43、deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and

44、 IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by t

45、he joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent

46、rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 27035 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. This first edition of ISO/IEC 27035 cancels and replaces ISO/IEC

47、 TR 18044:2004, which has been technically revised. CAN/CSA-ISO/IEC 27035:13ISO/IEC 27035:2011(E) vi ISO/IEC 2011 All rights reservedIntroduction In general, information security policies or controls alone will not guarantee total protection of information, information systems, services or networks.

48、 After controls have been implemented, residual vulnerabilities are likely to remain that can make information security ineffective and thus information security incidents possible. This can potentially have both direct and indirect adverse impacts on an organizations business operations. Further, i

49、t is inevitable that new instances of previously unidentified threats will occur. Insufficient preparation by an organization to deal with such incidents will make any response less effective, and increase the degree of potential adverse business impact. Therefore, it is essential for any organization serious about information security to