Куда я попал?
CIS Critical Security Controls v8 (The 18 CIS CSC)
Framework
17.1
Для проведения оценки соответствия по документу войдите в систему.
Список требований
Похожие требования
NIST Cybersecurity Framework (RU):
DE.DP-1
DE.DP-1: Для обеспечения подотчетности четко определены роли и обязанности по выявлению
RS.CO-1
RS.CO-1: Персонал знает свои роли и порядок действий, при выполнении мероприятий по реагированию
ID.GV-2
ID.GV-2: Роли и обязанности в области информационной безопасности скоординорованы и согласованы с внутренними ролями и внешними партнерами
Guideline for a healthy information system v.2.0 (EN):
40 STANDARD
/STANDARD
Noticing unusual behaviour from a workstation or a server (impossible connection, significant activity, unusual activity, unauthorised open services, files created, modified or deleted without authorisation, multiple anti-virus warnings, etc.) may be a warning of a possible intrusion.
A bad reaction in the event of a security incident can make the situation worse and prevent the problem from being dealt properly. The right reaction is to disconnect the device from the network, to stop the attack. However, you must keep it powered and not restart it, so as to not lose useful information for analysing the attack. You must then alert the management, as well as the information system security point of contact.
He or she may get in contact with the security incident response service providers (PRIS) in order to carry out the necessary technical operations (physically copying the disk, analysing the memory, logs and possible malware, etc.) and determine if other elements of the information system have been compromised. This will also concern coming up with a response to provide, in order to remove possible malware and the access that the hacker may have and to change compromised passwords. Any incident must be recorded in a centralised register. Charges may also be pressed with the competent legal service.
Noticing unusual behaviour from a workstation or a server (impossible connection, significant activity, unusual activity, unauthorised open services, files created, modified or deleted without authorisation, multiple anti-virus warnings, etc.) may be a warning of a possible intrusion.
A bad reaction in the event of a security incident can make the situation worse and prevent the problem from being dealt properly. The right reaction is to disconnect the device from the network, to stop the attack. However, you must keep it powered and not restart it, so as to not lose useful information for analysing the attack. You must then alert the management, as well as the information system security point of contact.
He or she may get in contact with the security incident response service providers (PRIS) in order to carry out the necessary technical operations (physically copying the disk, analysing the memory, logs and possible malware, etc.) and determine if other elements of the information system have been compromised. This will also concern coming up with a response to provide, in order to remove possible malware and the access that the hacker may have and to change compromised passwords. Any incident must be recorded in a centralised register. Charges may also be pressed with the competent legal service.
ГОСТ Р № ИСО/МЭК 27001-2021 от 01.01.2022 "Информационная технология. Методы и средства обеспечения безопасности. Системы менеджмента информационной безопасности. Требования - Приложение А":
A.16.1.1
A.16.1.1 Обязанности и процедуры
Мера обеспечения информационной безопасности: Должны быть установлены обязанности и процедуры менеджмента для обеспечения уверенности в быстром, эффективном и надлежащем реагировании на инциденты информационной безопасности
Мера обеспечения информационной безопасности: Должны быть установлены обязанности и процедуры менеджмента для обеспечения уверенности в быстром, эффективном и надлежащем реагировании на инциденты информационной безопасности
CIS Critical Security Controls v7.1 (SANS Top 20):
CSC 19.3
CSC 19.3 Designate Management Personnel to Support Incident Handling
Designate management personnel, as well as backups, who will support the incident handling process by acting in key decision-making roles.
Designate management personnel, as well as backups, who will support the incident handling process by acting in key decision-making roles.
CSC 19.2
CSC 19.2 Assign Job Titles and Duties for Incident Response
Assign job titles and duties for handling computer and network incidents to specific individuals, and ensure tracking and documentation throughout the incident through resolution.
Assign job titles and duties for handling computer and network incidents to specific individuals, and ensure tracking and documentation throughout the incident through resolution.
Стандарт № ИСО/МЭК 27001:2022(E) от 25.10.2022 "Информационная безопасность, кибербезопасность и защита частной жизни — Системы управления информационной безопасностью — Требования. Приложение А":
А.5.24
А.5.24 Планирование и подготовка в отношении инцидентов ИБ
Организация должна организовать процесс управления инцидентами ИБ путем определения, установления и коммуникации процессов управления инцидентами ИБ, ролей и обязанностей.
Организация должна организовать процесс управления инцидентами ИБ путем определения, установления и коммуникации процессов управления инцидентами ИБ, ролей и обязанностей.
NIST Cybersecurity Framework (EN):
DE.DP-1
DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability
ID.GV-2
ID.GV-2: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners
RS.CO-1
RS.CO-1: Personnel know their roles and order of operations when a response is needed
Стандарт № ISO/IEC 27001:2022(E) от 25.10.2022 "Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Annex A":
А.5.24
А.5.24 Information security incident management planning and preparation
The organization shall plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities.
The organization shall plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities.
Связанные защитные меры
Ничего не найдено
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.