+Operations
---+O-IM Incident Management
------+O-IM-A Stream A: Incident Detection
---------+O-IM-1-A Use best-effort incident detection
---------+O-IM-2-A Define an incident detection process
---------+O-IM-3-A Improve the incident detection process
------+O-IM-B Stream B: Incident Response
---------+O-IM-1-B Create an incident response plan
---------+O-IM-2-B Define an incident response process
---------+O-IM-3-B Establish an incident response team
---+O-EM Environment Management
------+O-EM-A Stream A: Configuration Hardening
---------+O-EM-1-A Use best-effort hardening
---------+O-EM-2-A Establish hardening baselines
---------+O-EM-3-A Perform continuous configuration monitoring
------+O-EM-B Stream B: Patching and Updating
---------+O-EM-1-B Practice best-effort patching
---------+O-EM-2-B Formalize patch management
---------+O-EM-3-B Enforce timely patch management
---+O-OM Operational Management
------+O-OM-A Stream A: Data Protection
---------+O-OM-1-A Organize basic data protections
---------+O-OM-2-A Establish a data catalog
---------+O-OM-3-A Respond to data breaches
------+O-OM-B Stream B: System Decommissioning / Legacy Management
---------+O-OM-1-B Identify unused applications
---------+O-OM-2-B Formalize decommissioning process
---------+O-OM-3-B Review application lifecycle state regularly

Operations

The Operations Business Function encompasses those activities necessary to ensure confidentiality, integrity, and availability are maintained throughout the operational lifetime of an application and its associated data. Increased maturity with regard to this Business Function provides greater assurance that the organization is resilient in the face of operational disruptions, and responsive to changes in the operational landscape.

1. Visão geral

O-IM Incident Management

Short description: This practice addresses activities carried out to improve the organization's detection of, and response to, security incidents.

Once your organization has applications in operation, you are likely to face security incidents. In this model, we define a security incident as a breach, or the threat of an imminent breach, of at least one asset's security goals, whether due to malicious or negligent behavior. Examples of security incidents might include: a successful Denial of Service (DoS) attack against a cloud application, an application user accessing private data of another by abusing a security vulnerability, or an attacker modifying application source code. The Incident Management (IM) practice focuses on dealing with these in your organization.

Historically, many security incidents have been detected months, or even years, after the initial breach. During the "dwell time" before an incident is detected, significant damage can occur, increasing the difficulty of recovery. Our first activity stream, Incident Detection, focuses on decreasing that dwell time.

Once you have identified that you are suffering from a security incident, it's essential to respond in a disciplined, thorough manner to limit the damage, and return to normal operations as efficiently as possible. This is the focus of our second stream.
O-EM Environment Management

Short description: This practice describes proactive activities carried out to improve and maintain the security of the environments in which the organization's applications operate.

The organization's work on application security doesn't end once the application becomes operational. New security features and patches are regularly released for the various elements of the technology stack you're using, until they become obsolete or are no longer supported.

Most of the technologies in any application stack are not secure by default. This is frequently intentional, to enhance backwards compatibility or ease of setup. For this reason, ensuring the secure operation of the organization's technology stack requires the consistent application of secure baseline configurations to all components. The Environment Management (EM) practice focuses on keeping your environment clean and secure.

Vulnerabilities are discovered throughout the lifecycles of the technologies on which your organization relies, and new versions addressing them are released on various schedules. This makes it essential to monitor vulnerability reports and perform orderly, timely patching across all affected systems.
O-OM Operational Management

Short description: This practice focuses on operational support activities required to maintain security throughout the product lifecycle.

The Operational Management (OM) practice focuses on activities to ensure security is maintained throughout operational support functions. Although these functions are not performed directly by an application, the overall security of the application and its data depends on their proper performance. Deploying an application on an unsupported operating system with unpatched vulnerabilities, or failing to store backup media securely, can make the protections built into that application irrelevant.

The functions covered by this practice include, but are not limited to: system provisioning, administration, and decommissioning; database provisioning and administration; and data backup, restore, and archival.

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos

3. Regulamentos relacionados

Regulamentos
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.