Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

CIS Critical Security Controls v8 (The 18 CIS CSC)



Для проведения оценки соответствия по документу войдите в систему.

Похожие требования

NIST Cybersecurity Framework (RU):
ID.SC-5: С критичными поставщиками проводится планирование, тестирование реагирования и восстановления 
Guideline for a healthy information system v.2.0 (EN):
Noticing unusual behaviour from a workstation or a server (impossible connection, significant activity, unusual activity, unauthorised open services, files created, modified or deleted without authorisation, multiple anti-virus warnings, etc.) may be a warning of a possible intrusion. 

A bad reaction in the event of a security incident can make the situation worse and prevent the problem from being dealt properly. The right reaction is to disconnect the device from the network, to stop the attack. However, you must keep it powered and not restart it, so as to not lose useful information for analysing the attack. You must then alert the management, as well as the information system security point of contact. 

He or she may get in contact with the security incident response service providers (PRIS) in order to carry out the necessary technical operations (physically copying the disk, analysing the memory, logs and possible malware, etc.) and determine if other elements of the information system have been compromised. This will also concern coming up with a response to provide, in order to remove possible malware and the access that the hacker may have and to change compromised passwords. Any incident must be recorded in a centralised register. Charges may also be pressed with the competent legal service. 
ГОСТ Р № ИСО/МЭК 27001-2021 от 01.01.2022 "Информационная технология. Методы и средства обеспечения безопасности. Системы менеджмента информационной безопасности. Требования - Приложение А":
A.6.1.3 A.6.1.3 Контакты с полномочными органами
Средства реализации: Должны поддерживаться соответствующие контакты с полномочными органами.
CIS Critical Security Controls v7.1 (SANS Top 20):
CSC 19.5 CSC 19.5 Maintain Contact Information For Reporting Security Incidents
Assemble and maintain information on third-party contact information to be used to report a security incident, such as Law Enforcement, relevant government departments, vendors, and Information Sharing and Analysis Center (ISAC) partners.
Strategies to Mitigate Cyber Security Incidents (EN):
Continuous incident detection and response with automated immediate analysis of centralised time-synchronised logs of allowed and denied computer events, authentication, file access and network activity.
Relative Security Effectiveness:  Excellent | Potential User Resistance:  Low | Upfront Cost:  Very High | Ongoing Maintenance Cost: Very High 
Host-based intrusion detection/prevention system to identify anomalous behaviour during program execution (e.g. process injection, keystroke logging, driver loading and persistence).
Relative Security Effectiveness:  Very Good | Potential User Resistance:   Low | Upfront Cost:  Medium | Ongoing Maintenance Cost:  Medium
Стандарт № ИСО/МЭК 27001:2022(E) от 25.10.2022 "Информационная безопасность, кибербезопасность и защита частной жизни — Системы управления информационной безопасностью — Требования. Приложение А":
А.5.5 Контакты с государственными органами и регуляторами
Организация должна установить и поддерживать контакты с соответствующими государственными органами и регуляторами.
NIST Cybersecurity Framework (EN):
ID.SC-5 ID.SC-5: Response and recovery planning and testing are conducted with suppliers and third-party providers
Стандарт № ISO/IEC 27001:2022(E) от 25.10.2022 "Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Annex A":
А.5.5 Contact with authorities
The organization shall establish and maintain contact with relevant authorities.

Связанные защитные меры

Ничего не найдено