+DER.2.1.A6 Recovering the Operating Environment After Security Incidents [IT Operation Department] (B)

DER.2.1.A6 Recovering the Operating Environment After Security Incidents [IT Operation Department] (B)

After a security incident, the affected components MUST be removed from the network. In addition, all necessary data that could provide information about the nature and cause of the problem MUST be backed up. On all the components affected, the operating systems and all applications MUST be checked for changes.

The original data MUST be reinstalled from write-protected data storage media. In so doing, all security-related configurations and patches MUST also be implemented. If data from backups is reimported, it MUST be ensured that the data was not affected by the security incident. After an attack, all access data on the affected components MUST be changed before they are put back into operation. The components affected SHOULD be subjected to a penetration test before they are used again.

When recovering the secure operating environment, the users MUST be involved in the functional tests of the applications. After everything has been recovered, the components (including the network transitions) MUST be monitored in a targeted manner.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.11 Failure or Disruption of Service Providers
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.25 Failure of Devices or Systems
blocks G 0.29 Violations of Laws or Regulations
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information