+RS.AN Incident Analysis
---+RS.AN-01 Notifications from detection systems are investigated
---+RS.AN-02 The impact of the incident is understood
---+RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident
---+RS.AN-04 Incidents are categorized consistent with response plans
---+RS.AN-05 Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. …
---+RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
---+RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved
---+RS.AN-08 An incident's magnitude is estimated and validated
|
RS.AN Incident Analysis
StatementInvestigations are conducted to ensure effective response and support forensics and recovery activities
1. Visão geral
| Título |
Norma |
|
RS.AN-01 Notifications from detection systems are investigated
|
StatementNotifications from detection systems are investigated
|
|
RS.AN-02 The impact of the incident is understood
|
StatementThe impact of the incident is understood
|
|
RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident
|
StatementAnalysis is performed to establish what has taken place during an incident and the root cause of the incident GuidanceDetermine the sequence of events that occurred during the incident and which assets and resources were involved in each event GuidanceAttempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident GuidanceAnalyze the incident to find the underlying, systemic root causes GuidanceCheck any cyber deception technology for additional information on attacker behavior
|
|
RS.AN-04 Incidents are categorized consistent with response plans
|
StatementIncidents are categorized consistent with response plans
|
|
RS.AN-05 Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. …
|
StatementProcesses are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)
|
|
RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
|
StatementActions performed during an investigation are recorded, and the records' integrity and provenance are preserved GuidanceRequire each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable GuidanceRequire the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported
|
|
RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved
|
StatementIncident data and metadata are collected, and their integrity and provenance are preserved GuidanceCollect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures
|
|
RS.AN-08 An incident's magnitude is estimated and validated
|
StatementAn incident's magnitude is estimated and validated GuidanceReview other potential targets of the incident to search for indicators of compromise and evidence of persistence GuidanceAutomatically run tools on targets to look for indicators of compromise and evidence of persistence
|
1.1 Referências
1.2 Requisitos identificados
1.3 Regulamentos relacionados
2. Requisitos identificados
Requisitos
| Fonte |
Requisito |
3. Regulamentos relacionados
Regulamentos
| Fonte |
Regulamentação |
Pedidos ligados
- NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.
DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.
|