iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
CEN

EN ISO/IEC 27041:2016

(Main)

Information technology - Security techniques - Guidance on assuring suitability and adequacy of incident investigative method (ISO/IEC 27041:2015)

Information technology - Security techniques - Guidance on assuring suitability and adequacy of incident investigative method (ISO/IEC 27041:2015)

This International Standard provides guidance on mechanisms for ensuring that methods and processes
used in the investigation of information security incidents are “fit for purpose”. It encapsulates best
practice on defining requirements, describing methods, and providing evidence that implementations of
methods can be shown to satisfy requirements. It includes consideration of how vendor and third-party
testing can be used to assist this assurance process.
This document aims to
— provide guidance on the capture and analysis of functional and non-functional requirements
relating to an Information Security (IS) incident investigation,
— give guidance on the use of validation as a means of assuring suitability of processes involved in the
investigation,
— provide guidance on assessing the levels of validation required and the evidence required from a
validation exercise,
— give guidance on how external testing and documentation can be incorporated in the validation
process.

Informationstechnik - IT-Sicherheitsverfahren - Leitfaden zur Sicherung der Eignung und Angemessenheit von Vorfall-Untersuchungsmethoden (ISO/IEC 27041:2015)

Technologies de l'information - Techniques de sécurité - Directives sur la façon d'assurer l'aptitude à l'emploi et l'adéquation d'une méthode d'investigation d'incident (ISO/IEC 27041:2015)

Informacijska tehnologija - Varnostne tehnike - Smernice za zagotavljanje primernosti in ustreznosti metod za preiskovanje incidentov (ISO/IEC 27041:2015)

Ta mednarodni standard podaja smernice za mehanizme za zagotavljanje, da so metode in postopki, uporabljeni pri preiskovanju informacijskih varnostnih incidentov, »primerni za uporabo«. Vključuje najboljše
prakse za opredeljevanje zahtev, opisovanje metod in zagotavljanje dokazov, da izvajanje metod izpolnjuje zahteve. Pri tem upošteva, kako lahko preskušanje prodajalcev in tretjih oseb pomaga pri tem procesu zagotavljanja.
Cilj tega dokumenta je
– podati smernice za zajemanje in analizo funkcionalnih in nefunkcionalnih zahtev
v zvezi s preiskovanjem informacijskih varnostnih (IS) incidentov,
– podati smernice za uporabo preverjanja kor sredstvo za zagotavljanje ustreznosti procesov, ki so del preiskave,
– podati smernice za ocenjevanje ravni potrebnega preverjanja in dokazov, potrebnih za
vajo iz preverjanja,
– podati smernice, kako je mogoče zunanje preskušanje in dokumentacijo vključiti v proces
preverjanja.

General Information

Status
Published
Publication Date
23-Aug-2016
Withdrawal Date
27-Feb-2017
ICS
35.030 - IT Security
35.040 - Information coding
Technical Committee
CEN/CLC/TC 13 - Cybersecurity and Data Protection
Drafting Committee
CEN/CLC/TC 13 - Cybersecurity and Data Protection
Current Stage
6060 - Definitive text made available (DAV) - Publishing
Start Date
24-Aug-2016
Due Date
02-Sep-2017
Completion Date
24-Aug-2016
Ref Project
SIST EN ISO/IEC 27041:2017 - Information technology - Security techniques - Guidance on assuring suitability and adequacy of incident investigative method (ISO/IEC 27041:2015)

Buy Standard

EN ISO/IEC 27041:2017EN ISO/IEC 27041:2017
PreviousNext
Standard
EN ISO/IEC 27041:2017
English language
29 pages
sale 10% off
Preview
sale 10% off
Preview
e-Library read for
1 day

Standards Content (Sample)

SLOVENSKI STANDARD
SIST EN ISO/IEC 27041:2017
01-januar-2017
Informacijska tehnologija - Varnostne tehnike - Smernice za zagotavljanje
primernosti in ustreznosti metod za preiskovanje incidentov (ISO/IEC 27041:2015)
Information technology - Security techniques - Guidance on assuring suitability and
adequacy of incident investigative method (ISO/IEC 27041:2015)
Informationstechnik - IT-Sicherheitsverfahren - Leitfaden zur Sicherung der Tauglichkeit
und Eignung von Vorfall-Untersuchungsmethoden (ISO/IEC 27041:2015)
Technologies de l'information - Techniques de sécurité - Directives sur la façon d'assurer
l'aptitude à l'emploi et l'adéquation d'une méthode d'investigation d'incident (ISO/IEC
27041:2015)
Ta slovenski standard je istoveten z: EN ISO/IEC 27041:2016
ICS:
35.030 Informacijska varnost IT Security
SIST EN ISO/IEC 27041:2017 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST EN ISO/IEC 27041:2017

---------------------- Page: 2 ----------------------

SIST EN ISO/IEC 27041:2017


EN ISO/IEC 27041
EUROPEAN STANDARD

NORME EUROPÉENNE

August 2016
EUROPÄISCHE NORM
ICS 35.040
English Version

Information technology - Security techniques - Guidance
on assuring suitability and adequacy of incident
investigative method (ISO/IEC 27041:2015)
Technologies de l'information - Techniques de sécurité Informationstechnik - IT-Sicherheitsverfahren -
- Directives sur la façon d'assurer l'aptitude à l'emploi Leitfaden zur Sicherung der Tauglichkeit und Eignung
et l'adéquation d'une méthode d'investigation von Vorfall-Untersuchungsmethoden (ISO/IEC
d'incident (ISO/IEC 27041:2015) 27041:2015)
This European Standard was approved by CEN on 19 June 2016.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions
for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Turkey and United Kingdom.





EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATIO N

EUROPÄISCHES KOMITEE FÜR NORMUN G

CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2016 CEN and CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 27041:2016 E
reserved worldwide for CEN and CENELEC national
Members.

---------------------- Page: 3 ----------------------

SIST EN ISO/IEC 27041:2017
EN ISO/IEC 27041:2016 (E)
Contents Page
European foreword . 3

2

---------------------- Page: 4 ----------------------

SIST EN ISO/IEC 27041:2017
EN ISO/IEC 27041:2016 (E)
European foreword
The text of ISO/IEC 27041:2015 has been prepared by Technical Committee Committee ISO/IEC JTC 1
“Information technology” of the International Organization for Standardization (ISO) and the
International Electrotechnical Commission (IEC) and has been taken over as EN ISO/IEC 27041:2016.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by February 2017, and conflicting national standards
shall be withdrawn at the latest by February 2017.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent
rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

CEN
EN ISO/IEC 27038:2016(Main)
Information technology - Security techniques - Specification for digital redaction (ISO/IEC 27038:2014)
SIST EN ISO/IEC 27038:2017

This International Standard specifies characteristics of techniques for performing digital redaction on
digital documents. This International Standard also specifies requirements for software redaction tools
and methods of testing that digital redaction has been securely completed.
This International Standard does not include the redaction of information from databases.
2 Terms

  • Standard
    17 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27042:2016(Main)
Information technology - Security techniques - Guidelines for the analysis and interpretation of digital evidence (ISO/IEC 27042:2015)
SIST EN ISO/IEC 27042:2017

This International Standard provides guidance on the analysis and interpretation of digital evidence
in a manner which addresses issues of continuity, validity, reproducibility, and repeatability. It
encapsulates best practice for selection, design, and implementation of analytical processes and
recording sufficient information to allow such processes to be subjected to independent scrutiny
when required. It provides guidance on appropriate mechanisms for demonstrating proficiency and
competence of the investigative team.
Analysis and interpretation of digital evidence can be a complex process. In some circumstances, there
can be several methods which could be applied and members of the investigative team will be required
to justify their selection of a particular process and show how it is equivalent to another process used
by other investigators. In other circumstances, investigators may have to devise new methods for
examining digital evidence which has not previously been considered and should be able to show that
the method produced is “fit for purpose”.
Application of a particular method can influence the interpretation of digital evidence processed by
that method. The available digital evidence can influence the selection of methods for further analysis
of digital evidence which has already been acquired.
This International Standard provides a common framework, for the analytical and interpretational
elements of information systems security incident handling, which can be used to assist in the
implementation of new methods and provide a minimum common standard for digital evidence
produced from such activities.

  • Standard
    25 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27043:2016(Main)
Information technology - Security techniques - Incident investigation principles and processes (ISO/IEC 27043:2015)
SIST EN ISO/IEC 27043:2017

This International Standard provides guidelines based on idealized models for common incident
investigation processes across various incident investigation scenarios involving digital evidence. This
includes processes from pre-incident preparation through investigation closure, as well as any general
advice and caveats on such processes. The guidelines describe processes and principles applicable to
various kinds of investigations, including, but not limited to, unauthorized access, data corruption,
system crashes, or corporate breaches of information security, as well as any other digital investigation.
In summary, this International Standard provides a general overview of all incident investigation
principles and processes without prescribing particular details within each of the investigation
principles and processes covered in this International Standard. Many other relevant International
Standards, where referenced in this International Standard, provide more detailed content of specific
investigation principles and processes.

  • Standard
    42 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27037:2016(Main)
Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012)
SIST EN ISO/IEC 27037:2017

ISO/IEC 27037:2012 provides guidelines for specific activities in the handling of digital evidence, which are identification, collection, acquisition and preservation of potential digital evidence that can be of evidential value.
It provides guidance to individuals with respect to common situations encountered throughout the digital evidence handling process and assists organizations in their disciplinary procedures and in facilitating the exchange of potential digital evidence between jurisdictions.
ISO/IEC 27037:2012 gives guidance for the following devices and circumstances:
Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto optical disks, data devices with similar functions,
Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards,
Mobile navigation systems,
Digital still and video cameras (including CCTV),
Standard computer with network connections,
Networks based on TCP/IP and other digital protocols, and
Devices with similar functions as above.
The above list of devices is an indicative list and not exhaustive.

  • Standard
    48 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27038:2016(Main)
Information technology - Security techniques - Specification for digital redaction (ISO/IEC 27038:2014)
SIST EN ISO/IEC 27038:2017

This International Standard specifies characteristics of techniques for performing digital redaction on
digital documents. This International Standard also specifies requirements for software redaction tools
and methods of testing that digital redaction has been securely completed.
This International Standard does not include the redaction of information from databases.
2 Terms

  • Standard
    17 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27043:2016(Main)
Information technology - Security techniques - Incident investigation principles and processes (ISO/IEC 27043:2015)
SIST EN ISO/IEC 27043:2017

This International Standard provides guidelines based on idealized models for common incident
investigation processes across various incident investigation scenarios involving digital evidence. This
includes processes from pre-incident preparation through investigation closure, as well as any general
advice and caveats on such processes. The guidelines describe processes and principles applicable to
various kinds of investigations, including, but not limited to, unauthorized access, data corruption,
system crashes, or corporate breaches of information security, as well as any other digital investigation.
In summary, this International Standard provides a general overview of all incident investigation
principles and processes without prescribing particular details within each of the investigation
principles and processes covered in this International Standard. Many other relevant International
Standards, where referenced in this International Standard, provide more detailed content of specific
investigation principles and processes.

  • Standard
    42 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27037:2016(Main)
Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012)
SIST EN ISO/IEC 27037:2017

ISO/IEC 27037:2012 provides guidelines for specific activities in the handling of digital evidence, which are identification, collection, acquisition and preservation of potential digital evidence that can be of evidential value.
It provides guidance to individuals with respect to common situations encountered throughout the digital evidence handling process and assists organizations in their disciplinary procedures and in facilitating the exchange of potential digital evidence between jurisdictions.
ISO/IEC 27037:2012 gives guidance for the following devices and circumstances:
Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto optical disks, data devices with similar functions,
Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards,
Mobile navigation systems,
Digital still and video cameras (including CCTV),
Standard computer with network connections,
Networks based on TCP/IP and other digital protocols, and
Devices with similar functions as above.
The above list of devices is an indicative list and not exhaustive.

  • Standard
    48 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27040:2016(Main)
Information technology - Security techniques - Storage security (ISO/IEC 27040:2015)
SIST EN ISO/IEC 27040:2017

ISO/IEC 27040:2015 provides detailed technical guidance on how organizations can define an appropriate level of risk mitigation by employing a well-proven and consistent approach to the planning, design, documentation, and implementation of data storage security. Storage security applies to the protection (security) of information where it is stored and to the security of the information being transferred across the communication links associated with storage. Storage security includes the security of devices and media, the security of management activities related to the devices and media, the security of applications and services, and security relevant to end-users during the lifetime of devices and media and after end of use.
Storage security is relevant to anyone involved in owning, operating, or using data storage devices, media, and networks. This includes senior managers, acquirers of storage product and service, and other non-technical managers or users, in addition to managers and administrators who have specific responsibilities for information security or storage security, storage operation, or who are responsible for an organization's overall security program and security policy development. It is also relevant to anyone involved in the planning, design, and implementation of the architectural aspects of storage network security.
ISO/IEC 27040:2015 provides an overview of storage security concepts and related definitions. It includes guidance on the threat, design, and control aspects associated with typical storage scenarios and storage technology areas. In addition, it provides references to other International Standards and technical reports that address existing practices and techniques that can be applied to storage security.

  • Standard
    120 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27042:2016(Main)
Information technology - Security techniques - Guidelines for the analysis and interpretation of digital evidence (ISO/IEC 27042:2015)
SIST EN ISO/IEC 27042:2017

This International Standard provides guidance on the analysis and interpretation of digital evidence
in a manner which addresses issues of continuity, validity, reproducibility, and repeatability. It
encapsulates best practice for selection, design, and implementation of analytical processes and
recording sufficient information to allow such processes to be subjected to independent scrutiny
when required. It provides guidance on appropriate mechanisms for demonstrating proficiency and
competence of the investigative team.
Analysis and interpretation of digital evidence can be a complex process. In some circumstances, there
can be several methods which could be applied and members of the investigative team will be required
to justify their selection of a particular process and show how it is equivalent to another process used
by other investigators. In other circumstances, investigators may have to devise new methods for
examining digital evidence which has not previously been considered and should be able to show that
the method produced is “fit for purpose”.
Application of a particular method can influence the interpretation of digital evidence processed by
that method. The available digital evidence can influence the selection of methods for further analysis
of digital evidence which has already been acquired.
This International Standard provides a common framework, for the analytical and interpretational
elements of information systems security incident handling, which can be used to assist in the
implementation of new methods and provide a minimum common standard for digital evidence
produced from such activities.

  • Standard
    25 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
CEN/TS 419221-1:2016(Main)
Protection Profiles for TSP cryptographic modules - Part 1: Overview
SIST-TS CEN/TS 419221-1:2017

This Technical Specification provides an overview of the protection profiles specified in other parts of CEN/TS 419221.

  • Technical specification
    12 pages
    English language
    sale 10% off
    e-Library read for
    1 day