GAP-analyse 1.20 DEF.xlsx colofon

Transcriptie

1 GAP-y 1.20 DEF.xx f A Dm V 1.2 R m BIG m Nm m D m Ifmb Gm 13-k-14 T GAP-y Imm BIG A GAP-y I mx m BIG m b GAP-y m km fmb m. Cy 2013 Kw N Gm (KING). A b. V, bk z z m z m bm m. V mmë w bj mm m m bkjk, f kk, bk w: 1. KING w b m. 2. m m mm ëx w. 3. b f fm w m bj kk b, bj w bk KING. 4. k m, f, zj z z f m m. R jw KING z bw wjk z bwb mjk z. Nm k KING kjk z km j, f. KING k kjk bk f f. I mwk m D B Ifmb N Gm (BIG) w mwk m: Wjz V: 1.1 Dm: Ek bk. Tk km "". V 1.2 Dm: Kmm GAP-y: m,, j. M m b k m m GAP y m kk. D kmm m zj b, w m zf m km j. P 1 f 20

2 GAP-y 1.20 DEF.xx j GAP-y m b B Ifmb N Gm ( 1.2) O : Dm : Gmm: DEEL 1 (GAP-Ay) DEEL 2 (ImAy) BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w B [A] E b fmb C I b Gk IBF 2014 bk N z Bm W, b b fmbb b BIG zj b z, k bjf wjz wjk b b bm? wjk B [A] H fmbb w mm éé k j, I fmbb f 3 j, z Gk IBF bk N z f z z bjk wjz, b z w? bj. Z k B [A] H C B&W wb I z, b wk m f Gk IBF bk N z fmb w, j f j bk b B&W k z m zj ï?. D b éé k j z, b wk Ifmbm bk k B&W. k C[A] D CISO (Cf Ifm Sy Off), Zj CISO f y Off jmm Gk IBF/P&O bk N z jmm zj b. b m bkk fmb zj ö. D CISO k m. m? b. D CISO b b m, z, f m.b.. b m m w f, km mm.q. b fmb m V[A] Ek jm wjk b Zj wjk w bf Gk IBF/P&O bk N z zj f. fmb jm b? G E k w IT z wjz I wjzb (bj ICT) k wkjk bk Gk I&A bk N z IT z. ( ITIL m : wjzb) w, b b? kg [A] D m m mb I b m mk k Gk P&O bk N z Ambw. 125, 3. (bjb fmbb m D mk bb m Bjz, f HR m) b k ( Ifm mk k, wz mk) k wjk fm. Hbj w mbë f, bff bjf m C [A] H jmm wk w I bk w w m Gk B&W bk N z m (bw, z, z.) w? CIB-fk fm x, I f w fmb fk Gk IBF bk N z w, fw w bk m fm w bk, bjb f fmb b. fm IBD (z jk) f fw? Zj m? C[A] D CISO m IBD m z IBD- IBD? I CISO? W z z m Gk IBF bk N z B [A] H fmbb w mm éé k Bjk IB b m z ë Gk IBF bk N z j ë ( fkjk k) w bj? I m PDCA-y? bj. Z k B [A] Pk b w W k b f Gk IBF bk N z jmm. x f jmm? B O f fmb w, fm Gk IBF bk N z P&C-y, jjk jmm. Bjk bk m w (bjb fmbb f P&C-y b) bjk fmb w? IIfmb b ( b fw) Bjk IB b m f f fk I&A / bk N z mw bj b x j w f k. b fw b x j () ff w f k? I Vf f b f Zj x mjk ym fk I&A / bk N z x b wk (fyk, wk f ) m bb m ym b m zj ff x j() m() bb m fk mk (f), zj ' k b w km wk zkjk f? bm zj. f P 2 f 19

3 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w IVf f b f Zj x mjk ym, f fk I&A / bk N z x b wk w fm, w m k k km m ff (bj. k II WBP f wjkk) f wm f (b) m bb m j k k km f bj ym b m zj fk mk bm zj. (f) w f? b bm? f IVf f b Z b, zj "b", Gk IBF bk N z x b fk mk ym w f? w I [A] I x j ym b w W ym m m x fk ff bk? N z wk w, w bwkkm (fm WBP k, z j, jk k 14) f. bwkkm? V k bjb 5 ym zj x w m 1 ym bwk km ) f IE m x j wk I /f bwkkm wk fk ff bk N z bm zj, z x j zj bm zj (bjb m ff w f b mjk z b), f b y w. (z k ). Ok w b b w, m bm b j zj w z? (bj. ) z. f IO fk x j w jjk Zj jjk fk, fk Aff bk N z. x j? B A zkjk b w b Dz b b w k w, fk ff bk N z fw ïmm bk b ym zj fw fm bjfm w.? BD m b bj zj f f D m , zj f fk ff bk N z f ïmm. f ïmm, bjk bjb BUb (wkk ) fw E b m m zj bm k Ik bk N z fm w.. m, kw, fk b fw wkk b, kjk, w w ( k SAAS / C ). w BI m x j m m D b k ff bk N z m wjz z w b w (wkk fw) m k z fw wjz. bj m BI m x j w m m C. k ff bk N z m mk BE bë w C. k ff bk N z w b bkb, wjk BI m x j C. fk ff bk N z kjk zj BA bk mk w m C. k ff bk N z zf b. D fm wjk b bj m mk fk BD, bj w, C. k ff bk N z j w, w b km fk km. Vb w ï w fk w I E bjfm I bjfm Gk I&A bk N z b w, z fm(zm), fw, b w z, fm(zm), w,, m k/. V k m fw, w,, m k/? w, bm wjk jm bk. V k m w, bm wjk jm bk EV k bjf,, zm ICT-f wjk jm bm A [A] E zj b bk bjfm (m m, -m mb ). D CAR-UWO mb z. V x AGbk bb k A A, fm mm m z mm f w mm. D mm k k w k ffk m mwk. I k bjf,, zm ICTf wjk jm bm? Zj b bk bjfm (m m, -m mb ). Bjb b fmbb f? I bww m w, w k? I b f fk w w m b f fm f mm m w mm Gk I&A bk N z Gk I&A bk N z Gk IBF bk N z Gk I&A/IBF bk N z P 3 f 19

4 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w A [A] Ifm w bk wjk A w bk wjk fm Gk I&A bk N z fm bkb k km b. zj m m m fm b z bm. (zk b, ICT.) R [A] D f bj. E zj bj b m? (Dz k Gk IBF bk N z bb f bb m) R I mm m WBP, I b b fk ff bk N z zj b (k 16 WBP)? b L [A] D jm f m ff m km - k k m b fm. bw / fm,. Dk bj z m b, my, fk P f / bk N z b L[A] D fm b B b b w Gk IBF bk N z b z fm. D z k bk. bfm b RD k wjk mwk zj m Zj fbj b m Gk P&O bk N z fbj w. I fbj fbj m. w mm b : fm bb bm bjfm b x m wjk b R [A] A mb mwk kj bj B " " w Gk P&O bk N z wjk z mb mwk bj fmb z. D fjk wjk, z fmb, z z fmb, kj? wk zj bj bb, w Okm f mk m mkkjk kjk z. Okm x j. Ok kjk f mk m x j. Ok. kjk R[A] I mwk wjk f... I b fbj f wkzm jk Gk P&O bk N z fmb m (f bj mk wk wjk z fwjz), bj k bf f bj f fmb mwk, bj k, b jk mk. bf f? RD m w b mwk B b wzj wjk Gk P&O bk N z b wzj wjk z z b? b. H b mwk bk zj m Zj mwk m bk? wjk b b S[A] V mwk (mb x mwk) Zj mwk VOG? I Gk P&O bk N z mm Vk Om G (VOG). I wf VGB. M m wf bf w k zk. (Vk G Bzw) SBj w mwk f k I b Gk P&O bk N z zj b f. w f S [A] H zkjk m VOG f k z bjk m? Gk P&O bk N z f AA b wkm, b Gk P&O bk N z x bk m w b k b, w wjk z fmb b zj DH jmm f wkk ïmm Dz k b : B,,, Gk P&O bk N z m bj k,. mmb ( k bjf b IB f) k bkk DH jmm b mmb, D b k b,, bww Gk P&O bk N z (w ) x bk m, myy bzk (bjb). ym m b km b b A mwk w m mk D b k b bk,, Gk IBF bk N z bb b, bww m, myy bzk w z f. (bjb) b [A] Bk w fmb f- wjz f w km Gk P&O bk N z bkk mwk f bk bjb k? w D [A] E mwk bk Z HR-b m? Gk P&O bk N z mk bb (z k: CAR/UWO 16, ff). P 4 f 19

5 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w B V mb mb f bf wk C f z b Gk P&O bk N z k bë b f bj ëfwjz k bj. V (zw bjf ). I w mk k B H jmm f bë C f z b. Gk P&O / bk N z b, f km w mm jm ëb w kk, m bjfm wk k bë b bj BH jmm f C f z. Gk P&O / bk N z f b, w mm b w jm ë kk m bjfm m zj bë f RZ Gk P&O / bk N z jm B Z Gk P&O / bk N z jm k kf D m m w z. C zb m. Gk H bk N z ydz z b :.Z 0: m bw b.z 1: wm kkm.z 2: wkm k.z 3: ICT-m / b m bjb bf V z (b f b bw) zj jk C f bz b zj. Gk H bk N z ybz b F Gbw b w (b b C f bw w b (bjb Gk H bk N z yfw) bj w z bk IT kmk, wk ). m F [A] E zj kk zm mk Zj bj bkb f w bk Gk H bk N z y, m m b wm w mk? kkm m w bzk km m m mb F E 24, 7 wk bwk; bkm k C fk f z. Gk H bk N z ym mmm F [A] V bwk f f zj C /. Gk H bk N z y wjk W P B Rb. Dz f w mm jjk kf I bw m m b z Zj m? Gk H / bk N z y. H w bj. H b z? I&A I? F [A] V m b, w W b bj Gk H bk N z yz wkzm k bjk? w. (bjb B, BHV.) F T bw f bz mjk I bw bz mjk Gk H bk N z y.? W w? F[A] D bz b zj I mjk b w Gk H bk N z yfm mjk b. bz b? FI bw m b z b z Zj b z? Gk H bk N z y. H w bj. H b z? I? F D kw m (,,, V wk m kw m fm Gk H bk N z y) fm z. z? FD f m w. I m f ( )? Gk H bk N z y F N m w b b Zj m b bm Gk H bk N z ybm. b? F A bkb kbm m Zj kbm? Gk I&A bk N z y zf... b z w H b z? mm. I? F [A] E mm éé k f j k W fjjk? Gk H bk N z y/ fyk. I? B P m mb wjk W m mb m fk P f / bk N z fm b w b. wjk fm b? P 5 f 19

6 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w S [A] E f b kz m wjz E fm b b Gk H bk N z mb m, b kz wjz mb, m b b fm. b fm [A] Sm, k Zj m, bkbym Gk I&A bk N z bkbym zj j m b. E b z TIA-942? b z b Tmm If Zj m bk? S f D C (TIA-942) BBj m k m fk b z f BR bk zj z f b éé zf m k z zw f bk/ m kjk zj B [A] B m w z bjfk b zj b w B[A] Bj bkk w bw w kz wbj k w m k m m zk m B Gjk f bb m zj z f b m m m z m f b m B [A] E bw k k bb. D w jjk W Mwk zf zj m b b jk zk kj fyk b m w IT z zj k f w m wjk fm w wk WB m (z m f k) w z b zj f w m. k W Z x mm m b b m m (f, f ) w mk. k O [A] E b m m kk b km - m bp A w fm f. D mm m,, b b PS w wjz bjb ww w wjz bj bkm P Gbw zj b bkm P E k b mm P E fmym j b k km bj wk fm. I mjk w ym bk fmwk w w N A b w bm m bk z B V- mmkb k f fm w bk, b f b w bm fm m NEN O[A] R (w) b, zj wz f kjk B A b w b m fyk bm z bjb m z zj b fw. I bj m k m fk b z bw f? I bk w k bk ff- bw w? W z f? Zj m m bjfk b w? Dk m bw f bjb w f m m bjfk. I bj bkk bw kz wbj k m k m m zk m? Zj b m bb f jk m? Bjb kkm f jk ff? I k bb? W z bb jjk? I b b fyk b m? B m f zj w m zj w m, bjk? Bjk? I b w b b m m m w mk? S jk? Gk H bk N z Gk I&A bk N z Gk I&A bk N z Gk H bk N z Gk H bk N z Gk H bk N z Gk H bk N z Gk H bk N z Gk H bk N z I m m /kk? Gk H bk N z C z mjk f fm f. - Tm b - b C f ww. C f f ww. Zj m m bkm, z j wk? B b mm b k? W ww? I BIG w zj ym b k wk m wjk. I fm wk w f ym bk w. W m bm UPS ym z m km? Gk I&A bk N z Gk I&A/IBF bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z Zj - mmkb bm fm NEN 1010? Gk I&A bk N z W m m b? I b w b? I b wj b fw? fyk bm bb? Zj m ïmm? Gk I&A bk N z Gk H bk N z P 6 f 19

7 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w V [A] Bj bë bk f bj f w W fm bj bë bk f f Gk I&A bk N z fm bj b. D bj ICT? b z w f z I w f ICT m? wz f kjk. A k w I wj? f fm fyk. H f f I f /? w bjf V [A] Hbk b I wj w Gk I&A bk N z fm wj m m. E z wk? m S E. I w w k m, éé k m m w f f j k V A, fm mm m I mm, fm f Gk I&A bk N z z mm f w mm. mm. I w mm m m, w mm f m m? GB b fm, f, Zj b : Gk I&A bk N z bk-, f f, b, -, m - f b. - bk- - f f - b m - - m b? G E zj b m Zj b m Gk I&A bk N z,, b, bk, z,,, b, bk, z, bk. bk W I wjzb mm b : I wjzb? Gk I&A bk N z m f wjz W b m? j my mjk wjz z k wjz W[A] I fmbf (b.. y fw) W fmbf (b.. y Gk I&A bk N z kk w w wk, w fw) kk w w jm wjz. wk, m wjz? z FNm f m I k b ym bk Gk I&A bk N z bb m y k ym? Bjb: b b f fmym b. D b m j f zj kmm b k zzf f m b f k b bj k zj. b. D zw fmwk b. A b, b k w bk mk f b b, m zf F[A] E bk bkk. I k bk bkk, m Gk I&A bk N z Bwkzm w w? b, m bkk w bk F [A] Vóó wk kk W wk kk fk I&A bk N z fm f kk fm ym k w z fm f kk fm ym k w ï. V w? w bj. E w bj? F[A] Vwjk b, wjz Zj wjk b, wjz Gk I&A bk N z bjb fmymf m wz bjb fmymf wz éé zj éé fk (b). fk (b)? E zj mm ym Owkk, T Zj mm ym Owkk, T Gk I&A bk N z /f A P (OTAP). D ym z /f A P (OTAP)? z bï ym z. (D ym z z bï ym z.) Gbk bb bkf Owkk, T /f A Pym m f m. H m jk zb zj wk ym wk w [A] I xm f bm m, z fyk m DD b j bjf wjk bwb b DUb k fmym wjk jm C E w fk mk, z m b C D bwb w m. D k bjb m f b mm j ( ym) CE zj b j k. Hbb bk bkf Owkk, T /f A Pym? W ym w / m wk ym wk w? I xm f bm m? A xm f bm m, z fyk m? Zj b IT ym? I wjk b j? Hf wjk m b fmym k? I k? Zj fk mk, z m b? I bwb jjk w m m / f? Zj bwjz m /? Zj x k/ bk? Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z fk I&A bk N z Gk I&A bk N z fk ff bk N z fk k ff bk N z P 7 f 19

8 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w B Z Bj b fmym: Sfk ff bk N z I wjzb? W b m : m f wjz my mjk wjz k wjz C[A] D ICT-z V ICT z km fk ff bk N z km bkb. E w z bkb? k ïmm m bkb m bwk Zj bkb? (bjb wz m I b? m bk m ). O b bk w m m C j [A] E w b bk b bk bwk. ym I b, m m m, w Gk I&A bk N z z bk mjk m, z bk mjk m k z k bk (f ym) m z m k f? zj f k m bkb ym bk (f ym) k b C [A] I k m x f w z w Zj k m w f x z? Gk I&A bk N z m ff m DDOS (D f S k) Zj m m m DDOS. H m? zj wk z, bkb f m S[A] V w bj. Zj ym? fk ff bk N z y k S E zj b. D Zj b ym mm OWASP f fk ff bk N z ybf mm OWASP f jkw. jkw? k Bjk z bk w bjb m ym? M [A] Bj b w z m Zj ym ï b Gk I&A bk N z, j mw. D bj? f fq, mm éé k, m V f jk? M[A] Ikm -m w, j mw. D f fq, mm éé k, (m) M I k k b f w bj k mm M [A] E zj m m m bk (bj. q mm) M E zj ï m w mm m bk mm zj b M O mb w fw, wbj bj BYOD bk z zf M Mb w ï m (bx) m k ym k. D mb w j m mm z ym w ME bk m x k k mm (bj. bw) mb R E zj () bk- y fm f wk R Bk-ë zj b (b, b, z.), mxm w m k, mxm b bk-- j R V bk- bjf m w bj, m k. D z kz /m kjk f k R Bk w bw z kz kjk bk R D fyk bk, zw ymj, z z k ff z bk M H wk w m b z, f f k k w bwb wk fk mmm km. Zj m ym ï b bj? V f jk? W k f mm bk? Zj m m m? I j, wk m? Zj ï m? Zj m bk mm b. Zj mb bk? I fw z mb? I BYOD b m? I b bk w fw bk? W bk mk ï m m mb? I k x mm' mb bkk bjb y? Zj bk y f fm /f wk? Zj z k? Zj bk- ë? E k m? I w bk zj kë k m mxm b? Zj bk- bw wj kjk? I z bk mjk? W bk mk wkm z f j k w? Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z fk k ff bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z P 8 f 19

9 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w M [A] Gw w w z W bk mk mw kkk Gk I&A bk N z jk m w wz (w w z)? mw M [A] Bj wjk fm w W bk mk y w fm Gk I&A bk N z wk, z, j k y w w wk w?. Z M E zj b f. W b f zj? Gk I&A bk N z B Bkmk, b Zj bkmk, Gk I&A bk N z wk b w ïf m b x wk. Ok k km wk, zw b? w b B[A] E zj ïmm Zj wjk fm Gk I&A bk N z wjk fm wjb m. wjb m z k, b-k? B [A] Vwjb m m wjk fm m Zj NIET b Gk I&A bk N z b w kjk zj z wjb m w? B I m k w bb W bj w mm bk m Gk I&A bk N z z b, w k w 75% z z j w ( mm k. mm 75% ) (j,, k) B G w b f W b fm f Gk I&A bk N z fbk. fbk? V[A] E zj wk wj Zj wj wjk Gk I&A bk N z wjk wjb m. wjb m? Wk m w bj? Vwj w m S E ww mjk. I w w k m, éé k m m jw f f j k. Z k PE b w b Zj z fm Gk I&A bk N z fm m z bm b k km b z bmk f mbk. fm mbk k w f bmk? B Symm wjk fm b j W ymm wjk fm b j Gk I&A bk N z kjk. b? B[A] W x k m b W ymm b fm b Sfk E bk N z ymm b m b, j z fw b m b? I j, w z fw. bjk? B[A] H mm Dm Vwjk f jkb W wjk fm b m Sfk E bk N z f fm, f, b m b f f zkjk? f f zkjk W bjk? BMwk zj ï m z m m Zj zj z bk bj mwk w Gk P&O bk N z (f)kk, -m, fx k b m m wjk fm? w bk b k kk wjk fm mm w BMwk zj ï m z m m mb Zj zj z bk bj mwk w Gk I&A bk N z wjb m k kk m m mb wjb m? wjk fm mm w. Hbj w m G k j b b j mb f? b mb f B Mwk zj ï m wjk m bj I wjk m f? Gk I&A bk N z BE zj m ff m m -W m m z m Gk I&A bk N z m b x -m km. x m b z m? UE zj fk mk b w Zj w wkfk f mm fk P f / bk N z fw w m m b wb wb zj bwb - w b wb - z? w wb zj b U Vwjk kjk I mm z wk? Gk I&A bk N z fmb zj b, m m. w UH mm I w mm? Gk I&A bk N z wjk bm,, mm zj. w U[A] I mjk w bkm mm (zw I mm bkm mm? Gk I&A bk N z fyk m w) wjz wk km f f. P 9 f 19

10 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w F Om wjk fm bm w m Zj m m m w fm bm? Gk I&A bk N z ym, z: (z b) bm fyk m, z f bk kkm w z f k jk f m z m z F[A] Fyk z bjz fm m Zj fyk z bjz fm? Gk H bk N z yk m, w zb, kb bk b E [A] D m b m w bk W bk mk f bk Gk I&A bk N z k mk bk PKI O f k m? k /f y. k E E (m) f -m b. I mf -m? Gk I&A bk N z k S E zj j m bkk b ' Zj j w b w z Gk IBF bk N z ybk mjk fm k m z bm bj bk b b k mb j b b z? fm b z k. H mm b fmz, mkjk ', fm m, y, bkb, bk km C E [A] Cfm w k b W k b bk? Gk I&A bk N z - bk (b.. GBA). (m, m bk) mo E w b () (kwf) W b m k k f Gk I&A bk N z k k f w (bj. TAN ) w? bk O E, j zj y W j Gk I&A bk N z bkk j wb. y wb? O E zj wb b fm Zj mwk fm Gk mm bk N z mwk. k b? bl V b w mk k w Zj? fk ff bk N z b. Dz w mjk mbk k. D GBA k bjb jk w, fë ym, I bk k bjb m f kw LE b mm: I w m (z )? Gk I&A bk N z jk b bkm f ID b (z ) w mjk wk f bj w w m j b L[A] I w m. B z ww? Gk I&A bk N z D bf m wm b bk k w (z ww, bmm, z.) L[A] Lb w zjk m. D zj ym W b zjk m? Gk I&A bk N z b bj k Sy Ifm E Mm ym (SIEM ) wm m m b w. E bj wk mw m m w LC : mm I mm? Gk I&A bk N z b b b w m m b. D k bw (m) mjk (bj. bkb ) LD b w m W b z m m Gk I&A bk N z :? bk bf, z wjz f f ; ymmm,, bk- f bk f bf, z wjz f, w f, (w b) bb, z f bk, k kk, ww, f kk y L b H (m) j (z f wz wj mw, b w W j, wj w Gk I&A bk N z w.? P 10 f 19

11 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w L [A] H b b I -y bk Gk I&A bk N z bk. Hbj bk. bkb? LLb w z bm z f W m km? Gk I&A bk N z m k w LD mm w z bm z W bm? Gk I&A bk N z f m k w. I m w z bj j w L[A] D bkb fm wb b I mm mj 3 m Gk I&A bk N z mj w y zkjk w, m mmm m w mm 3 j? m, fm w ym. Bj (m) fmb bwmj mm j LC : mm I m? Gk I&A bk N z b b b w m m b. D k bw (m) mjk (bj. bkb ) LZ Gk I&A bk N z LZ Gk I&A bk N z LSymkkk w z y j L ymkkk jk? Gk I&A bk N z bwb y b mjk TE b b w, m I b? Gk I&A bk N z b b bjf b R Gbk w f ïf. V I w bk? fk ff bk N z w m bj. k R [A] A w bj éé bb z W 1 bb bj k? Gk I&A bk N z R [A] O b fw w b w wk wjz I fw bj b fk ff bk N z f w wk w f? k B Gbk bb b z W b bk z zj? Gk I&A bk N z f k zkjk ( kw, ) B Sym bkm ( D ym? Gk I&A bk N z f ), z z ym f bk B Gbk kj zkjk Kj bk z bb? Gk I&A bk N z mm B E wjz b bj I b bj wk..m. wjz fk ff bk N z f / f. b? k B Ww w m (x) f W ww bm f Gk I&A bk N z, m w bjb w ( + SALT) ww mb m B T z ww : I ww f b w Gk I&A bk N z Ww w m ( m m w? bk). Tjjk ww f ww w f w w m w bj bk jk ww. Gbk b ww. Ww zj bj bk bk. Ww b mm 8 kk, w m 1 f, 1 jf 1 m k. Ww zj mxm 60 m b 6 bk w BT bk w k, mm jjk, W mm jjk ë? Gk I&A bk N z ë. H b b b b. P 11 f 19

12 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w G A bk k m mm Zj bk bz? Gk IBF bk N z : b Ww w. Gbk ww m. Ww m zj E ww w mjk wjz m k b bk w. Ww w bk m (bj. f f m). w OD bk wkk j fwz. (z k : I k y? Gk IBF bk N z ) b C I k b mm bk E : Gk IBF bk N z wjk fm b m. Dz fm D bk wjk fm b m m j w b fb bmjk. Dz fm m j w b fb (k, k, b f km). bmjk (k, k, b f km) CBj fkk fm w, w mjk, bk I f b fkk fm? Gk IBF bk N z mk f b fkk ( f) C[A] Smbmm ( ) mk I m wk mxm 15 Gk I&A bk N z mxm 15 m fm m? bm b kjk C[A] Tb k w m bj I k/ m wk k Gk I&A bk N z wj k ( wz). wj w? I wz! BE m b m bkk bk I wkbk b? Gk I&A bk N z wk wk. Gbk kj wk wk zkjk zj. Z k AZ k Gk I&A bk N z I [A] A ïf k w I k w Gk I&A bk N z w z. E,, w z? (B Y Ow D) w w z BP, jk z wk f I mm? Gk I&A bk N z m zj w f S [A] Wk w z k I k wk z mjk? Gk I&A bk N z z f wk mjk S[A] D z b f I b z w z ë? Gk I&A bk N z bm w wk z w. V ym w bj wk z z. E w k, mm éé k j, ë f ym m z z f m w S[A] Ek z f f b Z f Hbb z f b? Gk I&A bk N z z fm z b b. Hbj, mm S[A] B z mm I b z? Gk I&A bk N z, z SZ w m z w f I? Gk I&A bk N z bk k zkjk ( z) BV mjk wk, w z z I b bj z j mjk Gk I&A bk N z j, b mjk wk? bk w bk, km b bjf (z 11.1) BNwk zj z bm Zj bm f b Gk I&A bk N z b mm f b bmm? bmm B [A] T k f m W bk mk w-f bj k f b fk ff bk N z b w b w-f.? k BH ww w m j. E I ww bj b? fk ff bk N z w fm b k BVf m w bk m I m bk bj? fk ff bk N z bk x k. P 12 f 19

13 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w B Bj w m j I bj m? fk ff bk N z f. Dz fm k bk k fm ff /f mbk ym B[A] N bkm 3 k ff ww I k? Gk I&A bk N z, w mm 10 m bkk. I k- k w, w bkk bk zk z k- ff f ww GBj f m w mm f bk f bm G Bj bk IT z w bk mm b ww. b G [A] A m zkjk ym ( z m f ) b. D w zj, w w k w bk ( ) ks E w m bk ww y(.. k ww, m wjz, wjz ww) S [A] Ww bb z b bj y Db ww w wjz. W ww, w bkk S [A] Ww zj ë ww bb yz bk m bj bk w wjz S D bk bb mjk ww kz y wjz. Hbj : bk zj ww k wjz, w bk w. km yf w kz ww m b GH bk mm wm ym- bm z k w bb w bk b k w b T [A] D wk mxm 15 m. D w PC. Bj m mk mxm 15 m bk w B [A] D f w b wjzzk f m. M 2-f BI w m mk - jfb B [A] Mmfw f mjk bk f B [A] Bj x bk w m k (w-f) bk B [A] E b bk w-f b k. B.. b m w f k w I [A] G ym (m bkb f wjk) b wz (ï) mm bb. I k w bk fyk f m D[A] H mb w mjk z bjffm w ( z f ). V z f () b, f f wjk, : mb (z m, b, m, bpda) b mjk m bm.m.. ww. V w m fw D[A] E zj, w mjk, z m - mm mb. mw D [A] Bj m f f w mmmjk m f. I f m? Gk I&A bk N z I mm ww bj bk ()? Gk I&A bk N z Hbb m? Gk I&A bk N z W m bk ww, bjb y ym f? I ww w fw, bjb y ym f? I k jjk ww bk, /y fw ww bj bk w wjz? Hbb bk mjk ww kz wjz? Hbj : bk zj ww k wjz, w bk w. km yf w kz ww b. bk mm wm ym bm z k w, bk b? I m 15 m f k wk? I k m z? W ym f f bj m, wbj b wjzzk f m w m 2 f? V bj w m 2 f? W b ym bk mk 2 f, z b m? Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z fk k ff bk N z Gk I&A bk N z k I&A bk N z k I&A bk N z k I&A bk N z Gk I&A bk N z fk k ff bk N z Gk I&A bk N z Zj ym ï ym? Gk I&A bk N z W mb b m bjffm? I z f fw bk f ww ()? O mb m w mw fw bk wk m w. W bj m f f mmmjk m f? Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z P 13 f 19

14 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w T E w b m k mm I wk b b m (?) Gk P&O bk N z k... wk wt E w b m wk wk ym I wk b wk ym w wk Gk P&O bk N z wk ym w wkk f ym m w? wkz m w. D b w bj I fw? k MDM- (mb wmm) T [A] D wkz zj w mjk z I wk z z wk wkk Gk P&O bk N z wkk ( f ) bjffm w k k w? ( z f ) mjk mw f wkk E mw w k w k km. km? wv w m fw ka I j w by mb I f w bj j Gk IBF bk N z m w. Ok bj wjz w y mb w? q mm. W k wjzb? ya I y, wkk W bj y, wkk fmym Gk I&A bk N z fmym w b b b? b. W mjk w bk mk b j (bj. ). y A Bj f w wbj b W bj b b mm fk ff bk N z f. f? k ya W m b w kz Zj b bk w Gk I&A bk N z b w bw. w bw? ya V b w m bk b b bk m b Gk I&A bk N z b z NBV k f b NBV f ISO/IEC 15408? f ISO/IEC (mm ). y AE x, C f Gk I&A bk N z ww mjk j. ww. C f f ww yv E m w. C f bj fk ff bk N z Dbj w mm w, k,. M m bb wb, k, j fm, bj NCSC f OWASP j. m (SQL-Ij) BE b mjk m k k B H fmym m f b wm k w f wk zj. Hm w m b wm (jk) - wkf k w B S f w km mm B Vwk zj bj k b z bj f /f wk fm k w w wk fm I E b w, k bm w ïmm, bwk bm b VD f mm' mk mjk m j k (bj. km) V Bj w z m j wjk bkb w (bj. b ) V A zkjk zj bk w ( kw) B D bk yf m zj m zj fkjk bwb k BBj z yf fw, b j B[A] D yf bz m m b b (z FIPS w mjk NBV). Zj mjk m. W /f wkf m m m / mjk wk w? Zj mm z f w km? Zj wk b f? (bjb wk bjb, bwk ). Zj z bm ïmm bwk bm b. (k fz, y, ). Zj mm' m f wbj j k w. W w m j wjk bkb (b bj f?) W bk mk kw, z zkjk zj bk w? W yf m bk zj f fkjk k? (bjb AES) I b z yf wbj fw mk, b j? V yf bz m b b? fk ff bk N z fk ff bk N z fk k fk k fk k fk k fk k fk k ff ff ff ff ff ff bk bk bk bk bk bk N z N z N z N z N z N z Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z P 14 f 19

15 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w S I b mm b, I, bk mk w yf b Gk I&A bk N z wjk. m wjk? S D yf w b I yf b wk Gk I&A bk N z b yf? b S D wjk yf zj wb I b b wb wjk Gk I&A bk N z j, bk,. j, bk,? S E w b w m I w b w m Gk I&A bk N z m mm. m mm? S [A] Bj k mm PKI O I mm bj k PKI? Gk I&A bk N z B A k f fw f K f fw f Gk I&A bk N z.? B Pmm b w ï W mm ï m Gk I&A bk N z m.? B Gï mm, f m w W ï mm, f m Gk I&A bk N z bj fb. bj fb? B E w ( ) fw W ( ) Gk I&A bk N z bk. fw bk? B V w bj. I bj mm? Gk I&A bk N z B E bk. I w f wjz mm Gk I&A bk N z bk / /? B H bk kë b W bk b m? E Gk I&A bk N z w m. I zkjk, w z mjk, w bk mk mjk m z wj. m wk z w wj? T D b w z mjk bk m W b z mjk bk Gk I&A bk N z b wjz bm. A, m b wjz bb. bm? T B () ym. S b () ym. (O-m)? Gk I&A bk N z P E b wjzmm b b I b wjzmm b Gk I&A bk N z z ITIL ASL. b z ITIL ASL? T V (z ) fwm m W (z ) fwm Gk I&A bk N z f w z j wk m f z m b. j wk m b m? RBj bmm mmkk W bj bmm Gk I&A bk N z w wjz. mmkk wjz? U O k w w m V k w w Gk IBF bk N z -. m - m kk fm? U E zj m m () fm I m m () fm Gk IBF bk N z k. (z ) k? (z ) U Ub wkk mm km W wjk b Gk IBF bk N z wjk b. E b wkk mm? w m ff m kw wjk W m ff m kw wjk bb (bj., bkb b (bj., bkb m, f, kw, m, f, kw, kjk). kjk)? B E b kwb; E b Gk IBF bk N z m mm m IBD, k kwb; m mm m, y kwb. IBD, k, y kwb BV fwm z f k W fwm z Gk I&A bk N z (bj k m) w f f k (bj k m) f () zj. H () zj? m, zj fk zj m. P 15 f 19

16 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w B I bkb, ' b m I m mm wbj Gk I&A bk N z w ë ( ' b m bkb, ' b m kwb k w m ' w ë? ) B [A] U/ kwb w k mbk W k z mjk, b wk, Gk I&A bk N z w w z mjk, ïmm?, mm b éé wk. M k b-/ m w bj BI bkb w I w NCSC f CERT w Gk I&A bk N z IBD f CERT z bjb NCSC. mm m m kwb m R E bb I mm z wk? Gk IBF bk N z, mb m -, w w m w m b R E mm m IBD. I mm m IBD? Gk IBF bk N z R [A] E (DSC) wz I b m ACIB /f VCIB wz? Gk Gm bk N z b. V k I k w b m S w wz m m.? RA b w ym W b ym Gk I&A bk N z ë IBD. IBD? R Vm f f f m W m f f f m Gk IBF bk N z m k b w j k mk b f k b mk fmb. fmb? R Ifm b, bjb W fm b k Gk I&A bk N z, f, bk w m kk bjb b. kk. D CISO bkjk k bj k mjk - Kjk CISO k m fm (bj m fm. k mjk)? RE m b zwkk I m b zwkk Gk I&A bk N z kk b m. kk b m? V E zj b. A Zj b? Gk I&A bk N z mwk b zj z. Zj mwk z? L D fm k b bm W fm k b Gk IBF bk N z w ë m bm b. (PDCA bm w ë m Cy) bm b? VV b I /k zm, bw Gk IBF bk N z b bwjm w zm, bw bwjm km f bwj bm (km f zb zj. bwj b zj )? m I[A] Cm w bk jjk bww-, W m bk jjk bww-, Gk I&A bk N z -. -? f W bjk? B E B Im Ay (BIA) w b w I B Im Ay (BIA) w b w Gk IBF bk N z ïf k ï bjf. ïf k ï bjf? A y zj wjjk I bj k b wjjk ï k b m j, ï m j,?. j f CI ï w mm b : Zj ï? Gk IBF bk N z I f ë bjf ï. w mm w b : W m w, m k w w f ë bjf ï. w. w m w, m k w w V fm (b fm ). w. P. fm (b Dm ym. fm). ï K k m w.. m ym. k k m w KE b k k bjfï W k k bjfï Gk IBF bk N z w f m bwk f m bwk zj, m zj, m fmb wjz fmb wjz b b m. m? [A] E w mm jjk f /f m [A] E w mm jjk f /f m Gk IBF bk N z bjfï m bjfï m (z, b wk). A (z, b wk). A w bj w bj. w bj w bj. P 16 f 19

17 GAP-y 1.20 DEF.xx j BIG Nmm GM V Awz V / mk E S A W? G? Gk/ PIOFAH fk /w IE wk w wjk m E z wz w wk w /f Gk IBF bk N z zj f. wjk m zj Dz j m : ()? Z j w z z? :// //2014/04/ _Cj--- Ifmb-040.f f IE z wjk m.b.. I z wjk m.b.. Gk Ik bk N z m, bk. m, bk? BBjk b w bm, W bjk b w bm fk ff bk N z, km wjk,, km wjk k, bjfm., bjfm? B D bm y b w W bm y bwk fk ff bk N z bwk km w, f km w, f k b. b? V E b m bkk bk IT z I b m bkk bk IT z Gk I&A bk N z bk. D b bkmk wk bk? w z D b bkmk wk w z kv E wk km, w f I bk wk km, w f bk Gk I&A bk N z yf k m. Z k yf wk m w? N H jmm wjk I zj b Gk IBF bk N z b (.. jjk mm. Dz k x zj. W k). Cfm BIG ( k) z CISO, m? Gm S, z bb. Dbj b k k b. Dz k w f w CISO w f x m N [A] I P&C y w fmb W P&C y fmb fk ff bk N z m. m? k C Ifmym w m W fmym m fk ff bk N z bm. D k bj. kwby bm? k. Z k Bjb kwby B E wbj w W wbj w fk ff bk N z ym, b z w ym, z k k k m bjf m bjf mmm mmm bk. bk? B T m fmym b W m fmym Gk I&A bk N z w bm m mjk mbk f mm b bm m mjk mbk f mm km. km? I D m ISMS wkk, I m ISMS? Gk IBF bk N z S b, b k W ISMS b? M bjf. Dz m kjk BIG m m S m b k m T b z w m. Bw m JA. b PDCA m (P, D, Ck, A). z k b P 17 f 19

18 GAP-y 1.20 DEF.xx GAP-y 1.20 DEF.xx S fmb b BIG m ( 1.2) R GAP-y Rw Lb P Mxmm S 5. Bb 0 / 2 = 0% 6. O fmb 0 / 27 = 0% 7. B bjfm 0 / 10 = 0% 8. P b 0 / 18 = 0% 9. Fyk b 0 / 41 = 0% 10. B mm b 0 / 81 = 0% 11. Tb 0 / 54 = 0% 12. Vw, wkk 0 / 43 = 0% 13. B 0 / 10 = 0% 14. Bjfb 0 / 5 = 0% 15. N 0 / 11 = 0% 104. ISMS 0 / 1 = 0% G T (m fk k, b b m mkk, k f) 15. N 14. Bjfb 13. B S GAP y m (GAP-y) 104. ISMS 5. Bb 0% 0%0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 6. O fmb 7. B bjfm 8. P b 9. Fyk b 12. Vw, wkk 11. Tb 10. B mm b S mm b IMPACT-y, b, 0-m ( ) Rw Lb P Mxmm S 5. Bb 0 / 4 = 0% 6. O fmb 0 / 54 = 0% 7. B bjfm 0 / 20 = 0% 8. P b 0 / 36 = 0% 9. Fyk b 0 / 82 = 0% 10. B mm b 0 / 162 = 0% 11. Tb 0 / 108 = 0% 12. Vw, wkk 0 / 86 = 0% 13. B 0 / 20 = 0% 14. Bjfb 0 / 10 = 0% 15. N 0 / 22 = 0% 104. ISMS 0 / 2 = 0% G T (m fk k, b b m mkk, k f) 15. N 14. Bjfb 13. B 104. ISMS 5. Bb 0% 0%0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 6. O fmb 7. B bjfm 8. P b 9. Fyk b 12. Vw, wkk 11. Tb 10. B mm b P 18 f 20

19 GAP-y 1.20 DEF.xx k L, k. P 19 f 20