EN ISO/IEC 27041:2016
(Main)Information technology - Security techniques - Guidance on assuring suitability and adequacy of incident investigative method (ISO/IEC 27041:2015)
Information technology - Security techniques - Guidance on assuring suitability and adequacy of incident investigative method (ISO/IEC 27041:2015)
This International Standard provides guidance on mechanisms for ensuring that methods and processes
used in the investigation of information security incidents are “fit for purpose”. It encapsulates best
practice on defining requirements, describing methods, and providing evidence that implementations of
methods can be shown to satisfy requirements. It includes consideration of how vendor and third-party
testing can be used to assist this assurance process.
This document aims to
— provide guidance on the capture and analysis of functional and non-functional requirements
relating to an Information Security (IS) incident investigation,
— give guidance on the use of validation as a means of assuring suitability of processes involved in the
investigation,
— provide guidance on assessing the levels of validation required and the evidence required from a
validation exercise,
— give guidance on how external testing and documentation can be incorporated in the validation
process.
Informationstechnik - IT-Sicherheitsverfahren - Leitfaden zur Sicherung der Eignung und Angemessenheit von Vorfall-Untersuchungsmethoden (ISO/IEC 27041:2015)
Technologies de l'information - Techniques de sécurité - Directives sur la façon d'assurer l'aptitude à l'emploi et l'adéquation d'une méthode d'investigation d'incident (ISO/IEC 27041:2015)
Informacijska tehnologija - Varnostne tehnike - Smernice za zagotavljanje primernosti in ustreznosti metod za preiskovanje incidentov (ISO/IEC 27041:2015)
Ta mednarodni standard podaja smernice za mehanizme za zagotavljanje, da so metode in postopki, uporabljeni pri preiskovanju informacijskih varnostnih incidentov, »primerni za uporabo«. Vključuje najboljše
prakse za opredeljevanje zahtev, opisovanje metod in zagotavljanje dokazov, da izvajanje metod izpolnjuje zahteve. Pri tem upošteva, kako lahko preskušanje prodajalcev in tretjih oseb pomaga pri tem procesu zagotavljanja.
Cilj tega dokumenta je
– podati smernice za zajemanje in analizo funkcionalnih in nefunkcionalnih zahtev
v zvezi s preiskovanjem informacijskih varnostnih (IS) incidentov,
– podati smernice za uporabo preverjanja kor sredstvo za zagotavljanje ustreznosti procesov, ki so del preiskave,
– podati smernice za ocenjevanje ravni potrebnega preverjanja in dokazov, potrebnih za
vajo iz preverjanja,
– podati smernice, kako je mogoče zunanje preskušanje in dokumentacijo vključiti v proces
preverjanja.
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
01-januar-2017
Informacijska tehnologija - Varnostne tehnike - Smernice za zagotavljanje
primernosti in ustreznosti metod za preiskovanje incidentov (ISO/IEC 27041:2015)
Information technology - Security techniques - Guidance on assuring suitability and
adequacy of incident investigative method (ISO/IEC 27041:2015)
Informationstechnik - IT-Sicherheitsverfahren - Leitfaden zur Sicherung der Tauglichkeit
und Eignung von Vorfall-Untersuchungsmethoden (ISO/IEC 27041:2015)
Technologies de l'information - Techniques de sécurité - Directives sur la façon d'assurer
l'aptitude à l'emploi et l'adéquation d'une méthode d'investigation d'incident (ISO/IEC
27041:2015)
Ta slovenski standard je istoveten z: EN ISO/IEC 27041:2016
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EN ISO/IEC 27041
EUROPEAN STANDARD
NORME EUROPÉENNE
August 2016
EUROPÄISCHE NORM
ICS 35.040
English Version
Information technology - Security techniques - Guidance
on assuring suitability and adequacy of incident
investigative method (ISO/IEC 27041:2015)
Technologies de l'information - Techniques de sécurité Informationstechnik - IT-Sicherheitsverfahren -
- Directives sur la façon d'assurer l'aptitude à l'emploi Leitfaden zur Sicherung der Tauglichkeit und Eignung
et l'adéquation d'une méthode d'investigation von Vorfall-Untersuchungsmethoden (ISO/IEC
d'incident (ISO/IEC 27041:2015) 27041:2015)
This European Standard was approved by CEN on 19 June 2016.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions
for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATIO N
EUROPÄISCHES KOMITEE FÜR NORMUN G
CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2016 CEN and CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 27041:2016 E
reserved worldwide for CEN and CENELEC national
Members.
Contents Page
European foreword . 3
European foreword
The text of ISO/IEC 27041:2015 has been prepared by Technical Committee Committee ISO/IEC JTC 1
“Information technology” of the International Organization for Standardization (ISO) and the
International Electrotechnical Commission (IEC) and has been taken over as EN ISO/IEC 27041:2016.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by February 2017, and conflicting national standards
shall be withdrawn at the latest by February 2017.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent
rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
Endorsement notice
The text of ISO/IEC 27041:2015 has been approved by CEN as EN ISO/IEC 27041:2016 without any
modification.
INTERNATIONAL ISO/IEC
STANDARD 27041
First edition
2015-06-15
Information technology — Security
techniques — Guidance on assuring
suitability and adequacy of incident
investigative method
Technologies de l’information — Techniques de sécurité — Directives
sur la façon d’assurer l’aptitude à l’emploi et l’adéquation d’une
méthode d’investigation d’incident
Reference number
ISO/IEC 27041:2015(E)
©
ISO/IEC 2015
ISO/IEC 27041:2015(E)
© ISO/IEC 2015
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2015 – All rights reserved
ISO/IEC 27041:2015(E)
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 4
5 Method development and assurance . 4
5.1 Overview . 4
5.2 General principles . 4
5.3 General development and deployment model . 4
5.4 Assurance stages . 5
5.5 Requirements capture and analysis . 6
5.5.1 General principles of requirements . 6
5.5.2 Functional Requirements . 7
5.5.3 Verification of requirements . 7
5.6 Process Design . 7
5.6.1 Overview . 7
5.6.2 Tool Selection . 7
5.6.3 Uncertainty and risk evaluation . 7
5.7 Process Implementation . 8
5.7.1 Overview . 8
5.7.2 Tool choice — guidance for deployment . 8
5.8 Process Verification . 8
5.8.1 General principles of verification . 8
5.8.2 Verification of processes . 9
5.8.3 Verification of tools . 9
5.9 Process Validation . 9
5.9.1 General principles of validation . 9
5.9.2 Comprehensive validation . 9
5.9.3 Sufficient validation . 9
5.9.4 Fully validated processes .10
5.9.5 Failed validation .10
5.10 Confirmation .10
5.11 Deployment .10
5.11.1 Tool choice .10
5.12 Review and Maintenance .10
6 Assurance Models .11
6.1 Overview .11
6.2 In-house assurance .11
6.3 External assurance .11
6.4 Mixed assurance .11
7 Production of evidence for assurance .11
7.1 Overview .11
7.2 Pre-validation preparation .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.