ISO/IEC 27039:2015

Information technology — Security techniques — Selection, deployment and operations of intrusion detection and prevention systems (IDPS)

ISO/IEC 27039:2015 provides guidelines to assist organizations in preparing to deploy intrusion detection and prevention systems (IDPS). In particular, it addresses the selection, deployment, and operations of IDPS. It also provides background information from which these guidelines are derived.

Technologies de l'information — Techniques de sécurité — Sélection, déploiement et opérations des systèmes de détection et prévention d'intrusion

General Information

• Status: Published
• Publication Date: 10-Feb-2015
• ICS: 35.030 - IT Security
• ICS: 35.040 - Information coding
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27/WG 4 - Security controls and services
• Current Stage: 9020 - International Standard under periodical review
• Start Date: 15-Jul-2025
• Completion Date: 15-Jul-2025

Relations

• Revises: ISO/IEC 18043:2006 - Information technology — Security techniques — Selection, deployment and operations of intrusion detection systems
• Effective Date: 10-Jul-2010

Standards Content (Sample)

INTERNATIONAL ISO/IEC
STANDARD 27039
First edition
2015-02-15
Information technology — Security
techniques — Selection, deployment
and operations of intrusion detection
systems (IDPS)
Technologies de l’information — Techniques de sécurité — Sélection,
déploiement et opérations des systèmes de détection d’intrusion
Reference number
©
ISO/IEC 2015
© ISO/IEC 2015
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2015 – All rights reserved

Foreword .v
Introduction .vi
1 Scope . 1
2 Terms and definitions . 1
3 Background . 5
4 General . 5
5 Selection . 6
5.1 Introduction . 6
5.2 Information security risk assessment. 7
5.3 Host or Network IDPS . 7
5.3.1 Overview . 7
5.3.2 Host-based IDPS (HIDPS) . 7
5.3.3 Network-based IDPS (NIDPS) . . 7
5.4 Considerations . 8
5.4.1 System environment . 8
5.4.2 Security protection mechanisms . 8
5.4.3 IDPS security policy . 8
5.4.4 Performance . 9
5.4.5 Verification of capabilities .10
5.4.6 Cost .10
5.4.7 Updates .11
5.4.8 Alert strategies .12
5.4.9 Identity management.12
5.5 Tools that complement IDPS .13
5.5.1 Overview .13
5.5.2 File integrity checkers .14
5.5.3 Firewall .14
5.5.4 Honeypots .14
5.5.5 Network management tools .15
5.5.6 Security Information Event Management (SIEM) tools .15
5.5.7 Virus/Content protection tools .16
5.5.8 Vulnerability assessment tools .16
5.6 Scalability .17
5.7 Technical support .17
5.8 Training .18
6 Deployment .18
6.1 Overview .18
6.2 Staged deployment .18
6.3 NIDPS deployment .19
6.3.1 Overview .19
6.3.2 Location of NIDPS inside an Internet firewall .20
6.3.3 Location of NIDPS outside an Internet firewall .20
6.3.4 Location of NIDPS on a major network backbone .21
6.3.5 Location of NIDPS on critical subnets .21
6.4 HIDPS deployment .21
6.5 Safeguarding and protecting IDPS information security .22
© ISO/IEC 2015 – All rights reserved iii

7 Operations .22
7.1 Overview .22
7.2 IDPS tuning .23
7.3 IDPS vulnerabilities .23
7.4 Handling IDPS alerts .23
7.4.1 Overview .23
7.4.2 Information Security Incident Response Team (ISIRT) .24
7.4.3 Outsourcing .24
7.5 Response options .25
7.5.1 Principles .25
7.5.2 Active response .25
7.5.3 Passive reaction .27
7.6 Legal Considerations .27
7.6.1 Overview .27
7.6.2 Privacy .27
7.6.3 Other legal and policy considerations .27
7.6.4 Forensics .27
Annex A (informative) Intrusion Detection and Prevention System (IDPS): Framework and
issues to be considered .28
Bibliography .48
iv © ISO/IEC 2015 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of t
...

INTERNATIONAL ISO/IEC
STANDARD 27039
First edition
2015-02-15
Corrected version
2016-05-01
Information technology — Security
techniques — Selection, deployment
and operations of intrusion detection
and prevention systems (IDPS)
Technologies de l’information — Techniques de sécurité — Sélection,
déploiement et opérations des systèmes de détection et prévention
d’intrusion
Reference number
©
ISO/IEC 2015
© ISO/IEC 2015, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO/IEC 2015 – All rights reserved

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Terms and definitions . 1
3 Background . 5
4 General . 5
5 Selection . 6
5.1 Introduction . 6
5.2 Information security risk assessment. 7
5.3 Host or Network IDPS . 7
5.3.1 Overview . 7
5.3.2 Host-based IDPS (HIDPS) . 7
5.3.3 Network-based IDPS (NIDPS) . . 7
5.4 Considerations . 8
5.4.1 System environment . 8
5.4.2 Security protection mechanisms . 8
5.4.3 IDPS security policy . 8
5.4.4 Performance . 9
5.4.5 Verification of capabilities .10
5.4.6 Cost .10
5.4.7 Updates .11
5.4.8 Alert strategies .12
5.4.9 Identity management.12
5.5 Tools that complement IDPS .13
5.5.1 Overview .13
5.5.2 File integrity checkers .14
5.5.3 Firewall .14
5.5.4 Honeypots .15
5.5.5 Network management tools .15
5.5.6 Security Information Event Management (SIEM) tools .15
5.5.7 Virus/Content protection tools .16
5.5.8 Vulnerability assessment tools .16
5.6 Scalability .17
5.7 Technical support .18
5.8 Training .18
6 Deployment .18
6.1 Overview .18
6.2 Staged deployment .19
6.3 NIDPS deployment .19
6.3.1 Overview .19
6.3.2 Location of NIDPS inside an Internet firewall .20
6.3.3 Location of NIDPS outside an Internet firewall .20
6.3.4 Location of NIDPS on a major network backbone .21
6.3.5 Location of NIDPS on critical subnets .21
6.4 HIDPS deployment .21
6.5 Safeguarding and protecting IDPS information security .22
7 Operations .22
7.1 Overview .22
7.2 IDPS tuning .23
7.3 IDPS vulnerabilities .23
7.4 Handling IDPS alerts .23
7.4.1 Overview .23
© ISO/IEC 2015 – All rights reserved iii

7.4.2 Information Security Incident Response Team (ISIRT) .24
7.4.3 Outsourcing .24
7.5 Response options .25
7.5.1 Principles .25
7.5.2 Active response .25
7.5.3 Passive reaction .27
7.6 Legal Considerations .27
7.6.1 Overview .27
7.6.2 Privacy .27
7.6.3 Other legal and policy considerations .27
7.6.4 Forensics .27
Annex A (informative) Intrusion Detection and Prevention System (IDPS): Framework and
issues to be considered .28
Bibliography .48
iv © ISO/IEC 2015 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see ww
...