安全管理国际信息安全技术标准发展英文版

安全管理--国际信息安全技术标准发展-英文版2024/3/24安全管理国际信息安全技术标准发展英文版WG1ISMSStandardsChairTedHumphreysVice-ChairAngelikaPlateWG4SecurityControls&ServicesChairMeng-ChowKangWG2SecurityTechniquesChairProf.KNaemuraWG3SecurityEvaluationChairMatsOhlinWG5PrivacyTechnology,IDmanagementandBiometricsChairKaiRannenbergISO/IECJTC1SC27ChairWalterFumyViceChairMarijikedeSoeteSecretaryKrystynaPassia安全管理国际信息安全技术标准发展英文版27000Fundamental&Vocabulary27004ISMSMeasurement27005ISMSRiskManagement27006AccreditationRequirements27001ISMSRequirements27003ISMSImplementationGuidanceInformationSecurityManagementSystems(ISMS)27002CodeofPracticeISMSFamily安全管理国际信息安全技术标准发展英文版Riskmanage;Preventoccurrence;ReduceimpactofoccurrencePreparetorespond;eliminateorreduceimpactSC27WG4RoadmapFrameworkInvestigatetoestablishfactsaboutbreaches;identifywhodoneitandwhatwentwrongUnknownandemergingsecurityissuesKnownsecurityissuesSecuritybreachesandcompromises安全管理国际信息安全技术标准发展英文版NetworkSecurity(27033)TTPServicesSecurityICTReadinessforBusinessContinuity(27031)SC27WG4RoadmapApplicationSecurity(27034)ForensicInvestigationCybersecurity(27032)IncludesISO/IEC24762,VulnerabilityMgmt,IDS,&IncidentResponserelatedstandardsAnti-Spyware,Anti-SPAM,Anti-Phishing,Cybersecurity-eventcoordination&informationsharingISO18028revision;WDfornewPart1,2&3;NewStudyPeriodonHomeNetworkSecurity1stWDavailableforcommentsFutureNPNewStudyPeriodproposed;Includesoutsourcingandoff-shoringsecurity安全管理国际信息安全技术标准发展英文版GapsbetweenReadiness&Response

ITSecurity,BCP,andDRPPlanning&ExecutionProtectDetectReact/ResponseITSecurityPlanningActivateBCPActivateDCRPPlanPrepare&TestPlanPrepare&TestBusinessContinuityPlanningDisasterContingency&RecoveryPlanningDisasterEventsITSystemsFailures安全管理国际信息安全技术标准发展英文版ICTReadinessforBusinessContinuityWhatisICTReadiness?PrepareorganizationICTtechnology(infrastructure,operation,applications),process,andpeopleagainstunforeseeablefocusingeventsthatcouldchangetheriskenvironmentLeverageandstreamlineresourcesamongtraditionalbusinesscontinuity,disasterrecovery,emergencyresponse,andITsecurityincidentresponseandmanagementWhyICTReadinessfocusonBusinessContinuity?ICTsystemsareprevalentinorganizationsICTsystemsarenecessarytosupportincident,businesscontinuity,disaster,andemergencyresponseandmanagementneedsBusinesscontinuityisincompletewithoutconsideringICTsystemsreadinessRespondingtosecurityincident,disasters,andemergencysituationsareaboutbusinesscontinuity安全管理国际信息安全技术标准发展英文版ImplicationsofICTReadinessOperationalStatusTimeIncidentCurrentIHM,BCMandDRPfocusonshorteningperiodofdisruptionandreducingtheimpactofanincidentbyriskmitigationandrecoveryplanning.T=0T=iT=kT=lT=j100%x%y%z%Earlydetectionandresponsecapabilitiestopreventsuddenanddrasticfailure,enablegradualdeteriorationofoperationalstatusandfurthershortenrecoverytime.BeforeimplementationofIHM,BCM,and/orDRPAfterimplementationofIHM,BCM,and/orDRPAfterimplementationofICTReadinessforBC安全管理国际信息安全技术标准发展英文版ICTReadinessforBusinessContinuityRe-proposedassingle-partstandard(Nov‘07)Structure(DRAFT,DocumentSC27N6274)IntroductionScopeNormativeReferencesTermsandDefinitionsOverview(ofICTReadinessforBusinessContinuity)ApproachBasedonPDCAcyclicalmodelExtendBCPapproach(usingRA,andBIA)IntroduceFailureScenarioAssessment(withFMEA)FocusonTriggeringEventsManagementofIRBCProgram安全管理国际信息安全技术标准发展英文版P2PFileSharingInstantMessagingBloggingWeb2.0CybersecurityIssuesSplogs,SPAM,SearchEnginePoisoningSpywareTrojansVirus/WormsSPAMExploitURLsPhishingTrojansVoIP/VideoPrivacy&InformationBreach安全管理国际信息安全技术标准发展英文版GlobalThreatLandscapePrevalenceofMaliciousSoftware–byCategory安全管理国际信息安全技术标准发展英文版WhatisCybersecurityDefinitionofCybersecurityoverlapsInternet/networksecurityNatureCybersecurityissuesOccursontheInternet(Cyberspace)Globalnature,multiplecountries,differentpolicyandregulations,differentfocusMultipleentities,simpleclientsystemtocomplexinfrastructureWeakestlinkandlowestcommondenominatorprevailHighlycreativelandscape–alwayschanging安全管理国际信息安全技术标准发展英文版CybersecurityCybersecurityconcernstheprotectionofassetsbelongingtobothorganizationsandusersinthecyberenvironment.Thecyberenvironmentinthiscontextisdefinedasthepublicon-lineenvironment(generallytheInternet)asdistinctfrom“enterprisecyberspace”(closedinternalnetworksspecifictoindividualorganizationsorgroupsoforganizations).安全管理国际信息安全技术标准发展英文版GuidelinesforCybersecurity“Bestpractice”guidanceinachievingandmaintainingsecurityinthecyberenvironmentforaudiencesasdefinedbelow.Addresstherequirementforahighlevelofco-operation,information-sharingandjointactionintacklingthetechnicalissuesinvolvedincybersecurity.Thisneedstobeachievedbothbetweenindividualsandorganizationsatanationallevelandinternationally.Theprimaryaudiencesforthestandardare:CyberspaceserviceproviderssuchasInternetServiceProviders(ISPs),webserviceproviders,outsourcinganddataback-upserviceproviders,on-linepaymentbureaux,on-linecommerceoperators,entertainmentserviceprovidersandothers.Enterprisesincludingnotonlycommercialorganizationsbutalsonon-profitbodiesandotherorganizationsinfieldssuchashealthcareandeducation.Governments.Endusers,whilehighlyimportant,arenotseenasakeytargetaudienceastheyarenotingeneraldirectusersofinternationalstandards.Thestandardwillnotoffertechnicalsolutionstoindividualcybersecurityissues,whicharealreadybeingdevelopedbyotherbodiesasdescribedbelow.安全管理国际信息安全技术标准发展英文版NetworkSecurityRevisionofISO/IEC18028Re-focus,re-scoping,andnewpartsPart1–Guidelines(Overview,Concepts,Principles)Part2–GuidelinesforDesignandImplementationPart3–ReferenceNetworkingScenarios:Risks,Design,Techniques,andControlIssuesPart4–SecuritycommunicationsbetweennetworksusingsecuritygatewaysPart5–SecuringremoteaccessPart6–SecuritycommunicationsbetweennetworksusingVirtualprivatenetworkPart7–to-be-named“technology”topic安全管理国际信息安全技术标准发展英文版SoftwareVulnerabilityDisclosures

OSversusapplicationvulnerabilitiesApplicationvulnerabilitiescontinuedtogrowrelativetooperatingsystemvulnerabilitiesasapercentageofalldisclosuresduring2006Supportstheobservationthatsecurityvulnerabilityresearchersmaybefocusingmoreonapplicationsthaninthepast安全管理国际信息安全技术标准发展英文版GuidelinesforApplicationSecurityReducesecurityproblemsattheapplicationlayersEliminatecommonweaknessesatcodeandprocesslevelsStrengthensecurityofcodebaseimproveapplicationsecurityandreliabilityMulti-partsstandards,includingCodeSecurityCertificationProcessSecurityCertificationCodeSecurityTestingandcertificationpermajorreleaseofapplicationProcessSecuritySecurityDevelopmentLifecycleAssuresecurityofcodefromdesigntooperation,includingminorreleases,patchdevelopment&releaseFocusonWeb-basedapplications(majorproblemareas)安全管理国际信息安全技术标准发展英文版GuidelinesforApplicationSecuritySpecifyanapplicationsecuritylifecycle,incorporatingthesecurityactivitiesandcontrolsforuseaspartofanapplicationlifecycle,coveringapplicationsdevelopedthroughinternaldevelopment,externalacquisition,outsourcing/offshoring1,orahybridoftheseapproaches.ProvideguidancetobusinessandITmanagers,developers,auditors,andend-userstoensurethatthedesiredlevelofsecurityisattainedinbusinessapplicationsinlinewiththerequirementsoftheorganization’sInformationSecurityManagementSystems(ISMS).Applicationsecurityaddressesallaspects