ISO/IEC 27035:2011 Information technology — Security techniques — Information security incident management
Information security controls are imperfect in various ways: controls can fail, work partially, or be completely missing (e.g. not implemented or not operational). Consequently, incidents are bound to happen since preventive controls are not totally reliable and effective.
Managing incidents effectively involves detective and corrective controls designed to minimize adverse impacts, gather forensic evidence (where applicable) and ‘learn the lessons’ in terms of prompting improvements to the ISMS, especially the implementation of more effective preventive controls.
Information security incidents commonly involve the exploitation of previously unrecognised and/or uncontrolled vulnerabilities, hence vulnerability management (e.g. applying relevant security patches to IT systems and addressing control weaknesses in procedures) is part preventive and part corrective action.
Scope and purpose
The standard covers the processes for managing information security events, incidents and vulnerabilities.
The standard expands on the information security incident management section of ISO/IEC 27002. The updated 2016 version is likely to include a cross-reference.
Structure and content
The standard lays out a process with 5 key stages:
Prepare to deal with incidents e.g. prepare an incident management policy, and establish a competent team to deal with incidents;
Identify and report information security incidents;
Assess incidents and make decisions about how they are to be addressed e.g. patch things up and get back to business quickly, or collect forensic evidence even if it delays resolving the issues;
Respond to incidents i.e. contain them, investigate them and resolve them;
Learn the lessons - more than simply identifying the things that might have been done better, this stage involves actually making changes that improve the processes.
The standard provides template reporting forms for information security events, incidents and vulnerabilities.
Status of the standard
Using ISO/IEC’s accelerated procedure, ISO/IEC 27035 upgraded and replaced ISO TR 18044. It was published in 2011.
A project is now revising and extending ISO/IEC 27035:2011, splitting it into three parts that are expected to be published in 2016. The three parts are at CD stage.
ISO/IEC 27035-1: principles of incident management (draft)
Scope & purpose: part 1 outlines the concepts underpinning information security incident management and introduces the remaining two parts.
Content: the incident management process is currently described in five phases:
Plan and prepare: establish an information security incident management policy, form an Incident Response Team etc.
Detection and reporting: someone has to spot and report “events” that might be or turn into incidents;
Assessment and decision: someone must assess the situation to determine whether it is in fact an incident;
Responses: contain, eradicate, recover from and forensically analyze the incident, where appropriate;
Lessons learnt: make systematic improvements to the organization’s management of information security risks as a consequence of incidents experienced.
Status: at CD stage.
ISO/IEC 27035-2: guidelines to plan and prepare for incident response (draft)
Scope & purpose: part 2 concerns assurance that the organization is in fact ready to respond appropriately to information security incidents that may yet occur. It addresses the rhetorical question “Are we ready to respond to an incident?”
Content: after the usual preamble sections follow 8 main clauses:
Establishing information security incident management policy
Updating of information security and risk management policies
Creating information security incident management plan
Establishing an Incident Response Team (IRT) [aka CERT or CSIRT]
Defining technical and other support
Creating information security incident awareness and training
Testing the information security incident management plan
... plus annexes with incident categorization examples, and notes on “legal and regulatory aspects” (mostly privacy).
Status: at CD stage.
ISO/IEC 27035-3: guidelines for incident response operations (draft)
Scope & purpose: part 3 offers guidance on managing and responding efficiently to information security incidents, using typical incident types to illustrate the approach. It also covers the establishment, organization and operation of the Incident Response Teams (IRTs).
Content: there are three main clauses covering IRTs (types, roles, structures, staffing); incident response operations (incident criteria and response processes i.e. monitoring, detecting, assessing, analysing, responding, reporting and learning lessons); and generic examples of incidents (such as denial of service and malware incidents). Annexes offer criteria for categorizing incidents and template forms.
The published version may link-in to the digital forensics standards in ISO27k, since incident response is often the first opportunity to identify that a situation may end up in court, hence the forensic process often starts here.
Status: at CD stage.
I don’t know why the standard is being split into three bits. The separate parts are of little value as standalone standards, divorced from the whole, although looking at the contents lists there is significant duplication between them. The project team seems to me to be making a meal of this ... but I’m a cynic, a long way from the action, and no doubt they have their reasons (I should probably dig out the original project proposal, scope and justification for splitting it into three but, on past experience, I’d be wasting my time!).
Anyway, we’ll see how it turns out in 2016 (perhaps earlier). More importantly is the matter of how well the standard sells and is adopted ... which thought triggers an interesting question: I wonder if anyone actually monitors and reports the obvious metrics on sales and uptake of the ISO27k standards, other than ISO/IEC 27001 which is covered by ISO’s annual survey?