1、 ETSI GS ISI 008 V1.1.1 (2018-06) Information Security Indicators (ISI); Description of an Overall Organization-wide Security Information and Event Management (SIEM) Approach Disclaimer The present document has been produced and approved by the Information Security Indicators (ISI) ETSI Industry Spe
2、cification Group (ISG) and represents the views of those members who participated in this ISG. It does not necessarily represent the views of the entire ETSI membership. GROUP SPECIFICATION ETSI ETSI GS ISI 008 V1.1.1 (2018-06) 2Reference DGS/ISI-008 Keywords cyber-defence, ICT, security ETSI 650 Ro
3、ute des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.ets
4、i.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference
5、 in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change o
6、f status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.
7、aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of
8、ETSI. The copyright and the foregoing restriction extend to reproduction in all media. ETSI 2018. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTETMare trademarks of ETSI registered for the benefit of i
9、ts Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its Members. GSMand the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI GS ISI 008 V1.1.1 (2018-06) 3Contents Intellectual Property Rights 4g3Foreword . 4g3Modal verbs termi
10、nology 5g3Introduction 5g31 Scope 7g32 References 7g32.1 Normative references . 7g32.2 Informative references 8g33 Definitions, symbols and abbreviations . 8g33.1 Definitions 8g33.2 Symbols 8g33.3 Abbreviations . 8g34 The central position and pivotal role of an event classification model and associa
11、ted indicators . 9g35 Required reference frameworks and procedures in the framework of a SOC/CSIRT organization. 9g36 Follow up indicators . 10g36.1 User Security policy efficiency measurement with incidents follow up 10g36.2 User security practices follow up . 11g36.3 Vulnerabilities and/or non-con
12、formities follow up in a continuous checking 11g37 Reaction to security events . 12g37.1 Necessity of a reaction . 12g37.2 Interest of a reference framework of reaction plans . 13g37.3 The criticality level of security events 13g37.4 Reaction plans description 14g37.5 Processing of non standard situ
13、ations . 15g38 SIEM approach contribution for meeting regulations and legislations 16g39 Legal aspects of a SIEM approach . 16g39.1 Evidence collection 16g39.2 Privacy protection. 17g310 Towards a necessary balance as regards prevention and reaction 18g311 Conclusions 18g3Annex A (informative): Auth
14、ors Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been
15、carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Trademarks The present document may include trademarks and/or tradenames
16、which are asserted and/or registered by their owners. ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does not constitute a
17、n endorsement by ETSI of products, services or organizations associated with those trademarks. Foreword This Group Specification (GS) has been produced by ETSI Industry Specification Group (ISG) Information Security Indicators (ISI). The present document is included in a series of 9 ISI 00x specific
18、ations. These 9 specifications are the following (see figure 1 summarizing the various concepts involved in event detection and interactions between all parts): ETSI GS ISI 001-1 1 addressing (together with its associated guide ETSI GS ISI 001-2 2) information security indicators, meant to measure a
19、pplication and effectiveness of preventative measures. ETSI GS ISI 002 3 addressing the underlying event classification model and the associated taxonomy. ETSI GS ISI 003 i.1 addressing the key issue of assessing an organizations maturity level regarding overall event detection (technology/process/p
20、eople) in order to weigh event detection results. ETSI GS ISI 004 addressing demonstration through examples how to produce indicators and how to detect the related events with various means and methods (with a classification of the main categories of use cases/symptoms). ETSI GS ISI 005 addressing w
21、ays to produce security events and to test the effectiveness of existing detection means within organization (for major types of events), which is a more detailed and a more case by case approach than ETSI GS ISI 003 one i.1 and which can therefore complement it. ETSI GS ISI 006 i.2 addressing anoth
22、er engineering part of the series, complementing ETSI GS ISI 004 and focusing on the design of a cybersecurity language to model threat intelligence information and enable detection tools interoperability. ETSI GS ISI 007 i.3 addressing comprehensive guidelines to build and operate a secured SOC, es
23、pecially regarding the architectural aspects, in a context where SOCs are often real control towers within organizations. ETSI GS ISI 008 addressing and explaining how to make SIEM a whole approach which is truly integrated within an overall organization-wide and not only IT-oriented cyber defence.
24、Figure 1 summarizes the various concepts involved in event detection and the interactions between the specifications. ETSI ETSI GS ISI 008 V1.1.1 (2018-06) 5GS ISG ISI Series Summary DefinitionReal eventsSecurity prevention measuresEvent detection measuresFake events (Simulation) Event reaction meas
25、uresDetectedeventsResidual risk (event model-centric vision)Figure 1: Positioning the 9 GS ISI against the 3 main security measures Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interp
26、reted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. Introduction The SIEM (Security Information and Event Management) field, which is an across the
27、 board outline to benefit from logs rolling up from various Information System security software packages (networks and servers), is now a well-known concept around the world. The very first SIEM projects in these countries in the years 2000, very often approached from a purely technical angle with
28、no clearly defined at the outset security aims, highlighted the lack of feedback provided by these projects for companies. Thus, the first and true goal of a SIEM approach is to check relevancy of existing ISMS (Information Security Management System), and the SIEM project is the cornerstone of the
29、ISMS architecture, in relation to its organizational, documentary, human, and technological aspects. The first concrete tendencies identified using this overall approach have shown that significant progress can be achieved within a few years (when there is an operational project on a company-wide ba
30、sis). With regard to ISMS relevancy checking, which should ensure the implementation of real security insurance throughout the organization, it is essential to make sure that the security policy is actually enforced and is effective. The first aspect involves monitoring of security practices complia
31、nce, in order to identify uses of the Information System not compliant to the established security rules, and to survey abuses of organization employees and partners more seriously. The second aspect means undertaken security investments effectiveness should be improved, in order to reduce the resid
32、ual risks to which the company Information System is exposed, those remaining risks being not covered by existing preventative measures. Moreover, this close monitoring brings greater precision and significance to the awareness campaigns for employees and partners, because the messages of these camp
33、aigns can be adapted to deal with not compliant or deviant practises identified on the ground. ETSI ETSI GS ISI 008 V1.1.1 (2018-06) 6So there is a joint with cyber risks and general reference frameworks in kind of a 3-player game, enabling to combine top-down and bottom-up approaches and to master
34、the complexity and provide a real and tangible value to the overall scheme. In this context, the ETSI GS ISI 002 3 event model and the associated ETSI GS ISI-001-1 1 and ETSI GS ISI-001-2 2 full set of indicators play a key and decisive role by being positioned at the crossroads of technical experti
35、se and governance, and unleashing multiple uses either at the technical level or at the overall governance or management level. ETSI ETSI GS ISI 008 V1.1.1 (2018-06) 71 Scope The present document defines and describes the various concepts and areas of a whole SIEM approach, which involves SOCs, CSIR
36、Ts and Security governance teams. A SIEM approach is usually associated with one or more of the following six major aims: To monitor in real-time security events, i.e. detection of those able to avoid existing preventative measures. To improve the communication and management of residual risks assoc
37、iated with previous security events, by means of the implementation of a reaction (immediate or not) and of protective measures. To ensure security policy enforcement, also called continuous checking (a term borrowed from the banking industry), by monitoring non-conformities and implementing feedbac
38、k processes. To investigate security events with evidence collection, according to a code of practise called “forensic“. To draw up detailed reports, using follow-up indicators which are often new and intended to complete existing security dashboards. To plan security, with the aim of streamlining t
39、he future security investments by measuring precisely the efficiency level of existing ones. The target groups of the present document are heads of detection and reaction teams, heads of Cyber defence teams and heads of security governance (CISOs). 2 References 2.1 Normative references References ar
40、e either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies. Referenced documents
41、which are not found to be publicly available in the expected location might be found at https:/docbox.etsi.org/Reference/. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are
42、necessary for the application of the present document. 1 ETSI GS ISI 001-1: “Information Security Indicators (ISI); Indicators (INC); Part 1: A full set of operational indicators for organizations to use to benchmark their security posture“. 2 ETSI GS ISI 001-2: “Information Security Indicators (ISI
43、); Indicators (INC); Part 2: Guide to select operational indicators based on the full set given in part 1“. 3 ETSI GS ISI 002: “Information Security Indicators (ISI); Event Model A security event classification model and taxonomy“. 4 Security Indicators Quick Reference Card (V1.1.2). NOTE: Available
44、 at https:/ ETSI ETSI GS ISI 008 V1.1.1 (2018-06) 82.2 Informative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest v
45、ersion of the referenced document (including any amendments) applies. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the application of the present docu
46、ment but they assist the user with regard to a particular subject area. i.1 ETSI GS ISI 003: “Information Security Indicators (ISI); Key Performance Security Indicators (KPSI) to evaluate the maturity of security event detection“. i.2 ETSI GS ISI 006: “Information Security Indicators (ISI); An ISI-c
47、ompliant Measurement and Event Management Architecture for Cyber Security and Safety“. i.3 ETSI GS ISI 007: “Guidelines for building and operating a secured SOC“. i.4 ISO/IEC 27002:2013: “Information technology - Security techniques - Code of practice for information security controls“. i.5 ISO/IEC
48、27004:2016: “Information technology - Security techniques - Information security management - Monitoring, measurement, analysis and evaluation“. i.6 ISO 27035-1:2016: “Information technology - Security techniques - Information security incident management - Part 1: Principles of incident management“
49、. i.7 ISO 27035-2:2016: “Information technology - Security techniques - Information security incident management - Part 2: Guidelines to plan and prepare for incident response“. 3 Definitions, symbols and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in ETSI GS ISI 001-2 2 apply. 3.2 Symbols For the purposes of the present document, the symbols given in ETSI GS ISI 0
