EN ISO/IEC 27043:2016
(Main)Information technology - Security techniques - Incident investigation principles and processes (ISO/IEC 27043:2015)
Information technology - Security techniques - Incident investigation principles and processes (ISO/IEC 27043:2015)
This International Standard provides guidelines based on idealized models for common incident
investigation processes across various incident investigation scenarios involving digital evidence. This
includes processes from pre-incident preparation through investigation closure, as well as any general
advice and caveats on such processes. The guidelines describe processes and principles applicable to
various kinds of investigations, including, but not limited to, unauthorized access, data corruption,
system crashes, or corporate breaches of information security, as well as any other digital investigation.
In summary, this International Standard provides a general overview of all incident investigation
principles and processes without prescribing particular details within each of the investigation
principles and processes covered in this International Standard. Many other relevant International
Standards, where referenced in this International Standard, provide more detailed content of specific
investigation principles and processes.
Informationstechnik - IT-Sicherheitsverfahren - Grundsätze und Prozesse für die Untersuchung von Vorfällen (ISO/IEC 27043:2015)
Technologies de l'information - Techniques de sécurité - Principes d'investigation numérique et les processus (ISO/IEC 27043:2015)
Informacijska tehnologija - Varnostne tehnike - Načela in postopki za preiskovanje incidentov (ISO/IEC 27043:2015)
Ta mednarodni standard podaja smernice na podlagi idealiziranih modelov za običajne
postopke za preiskovanje incidentov v različnih scenarijih preiskovanja incidentov, ki vključujejo digitalne dokaze. Vključeni so postopki priprave na incident prek zaključka preiskave ter splošni nasveti in opozorila v zvezi s takimi postopki. Smernice opisujejo postopke in načela za različne preiskave, ki med drugim vključujejo nepooblaščen dostop, poškodbo podatkov, zrušitev sistema ali poslovno kršitev varnosti podatkov ter druge digitalne preiskave.
Če povzamemo, ta mednarodni standard podaja splošen pregled vseh načel in postopkov za preiskovanje incidentov, pri čemer ne predpisuje posebnih podrobnosti v zvezi s posameznimi načeli in postopki preiskovanja, ki so obravnavani v tem mednarodnem standardu. Številni drugi ustrezni mednarodni standardi, kjer je tako navedeno v tem mednarodnem standardu, zagotavljajo podrobnejše informacije o določenih načelih in postopkih preiskovanja.
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
01-januar-2017
,QIRUPDFLMVNDWHKQRORJLMD9DUQRVWQHWHKQLNH1DþHODLQSRVWRSNL]DSUHLVNRYDQMH
LQFLGHQWRY ,62,(&
Information technology - Security techniques - Incident investigation principles and
processes (ISO/IEC 27043:2015)
Informationstechnik - IT-Sicherheitsverfahren - Grundsätze und Prozesse für die
Untersuchung von Vorfällen (ISO/IEC 27043:2015)
Technologies de l'information - Techniques de sécurité - Principes d'investigation
numérique et les processus (ISO/IEC 27043:2015)
Ta slovenski standard je istoveten z: EN ISO/IEC 27043:2016
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EN ISO/IEC 27043
EUROPEAN STANDARD
NORME EUROPÉENNE
August 2016
EUROPÄISCHE NORM
ICS 35.040
English Version
Information technology - Security techniques - Incident
investigation principles and processes (ISO/IEC
27043:2015)
Technologies de l'information - Techniques de sécurité Informationstechnik - IT-Sicherheitsverfahren -
- Principes d'investigation numérique et les processus Grundsätze und Prozesse für die Untersuchung von
(ISO/IEC 27043:2015) Vorfällen (ISO/IEC 27043:2015)
This European Standard was approved by CEN on 19 June 2016.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions
for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATIO N
EUROPÄISCHES KOMITEE FÜR NORMUN G
CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2016 CEN and CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 27043:2016 E
reserved worldwide for CEN and CENELEC national
Members.
Contents Page
European foreword . 3
European foreword
The text of ISO/IEC 27043:2015 has been prepared by Technical Committee ISO/IEC JTC 1 “Information
technology” of the International Organization for Standardization (ISO) and the International
Electrotechnical Commission (IEC) and has been taken over as EN ISO/IEC 27043:2016.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by February 2017, and conflicting national standards
shall be withdrawn at the latest by February 2017.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent
rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
Endorsement notice
The text of ISO/IEC 27043:2015 has been approved by CEN as EN ISO/IEC 27043:2016 without any
modification.
INTERNATIONAL ISO/IEC
STANDARD 27043
First edition
2015-03-01
Information technology — Security
techniques — Incident investigation
principles and processes
Technologies de l’information — Techniques de sécurité — Principes
d’investigation numérique et les processus
Reference number
ISO/IEC 27043:2015(E)
©
ISO/IEC 2015
ISO/IEC 27043:2015(E)
© ISO/IEC 2015
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2015 – All rights reserved
ISO/IEC 27043:2015(E)
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 3
5 Digital investigations . 4
5.1 General principles . 4
5.2 Legal principles . 4
6 Digital investigation processes . 5
6.1 General overview of the processes . 5
6.2 Classes of digital investigation processes . 5
7 Readiness processes . 7
7.1 Overview of the readiness processes . 7
7.2 Scenario definition process . 9
7.3 Identification of potential digital evidence sources process . 9
7.4 Planning pre-incident gathering, storage, and handling of data representing
potential digital evidence process .11
7.5 Planning pre-incident analysis of data representing potential digital evidence process .11
7.6 Planning incident detection process .11
7.7 Defining system architecture process .11
7.8 Implementing system architecture process .12
7.9 Implementing pre-incident gathering, storage, and handling of data representing
potential digital evidence process .12
7.10 Implementing pre-incident analysis of data representing potential digital
evidence process .12
7.11 Implementing incident detection process .12
7.12 Assessment of implementation process .13
7.13 Implementation of assessment results process .13
8 Initialization processes .13
8.1 Overview of initialization processes .13
8.2 Incident detection process .14
8.3 First response process.15
8.4 Planning process .15
8.5 Preparation process.15
9 Acquisitive processes .16
9.1 Overview of acquisitive processes .16
9.2 Potential digital evidence identification process .16
9.3 Potential digital evidence collection process .17
9.4 Potential digital evidence acquisition process .17
9.5 Potential digital evidence transportation process .17
9.6 Potential digital evidence storage and preservation process .17
10 Investigative processes .18
10.1 Overview of investigative processes .18
10.2 Potential digital evidence acquisition process .19
10.3 Potential digital evidence examination and analysis process .19
10.4 Digital evidence interpretation process .19
10.5 Reporting process .19
10.6 Presentation process .20
10.7 Investigation closure process .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.