GAP-analyse 1.24 concept.xlsx colofon

Transcriptie

1 GAP-y 1.24 p.xx f A Dm Ifmb Gm 29-j-14 V R m BIG m Nm m T p GAP-y Impm BIG A GAP-y D m I mx m BIG m bp GAP-y m km fmbp m. Cpy 2015 Kw N Gm (KING). A b. V, p bk z z m z m bm m. V mmë w bj mm m m bkjk, f kk, p bk w: 1. KING w b m. 2. m m mm ëxp w. 3. pb f fm w m bj kk b, bj wp bpk p KING. 4. kp m, f, zj z z pf m m. R jw KING z bw wjk z bwb mjk z. Nm k KING pkjk z km j, f. KING k pkjk bk f f p. Wjz V: 1.1 Dm: Ek p bk p. Tk p km "". V 1.2 Dm: Kmm GAP-y: m,, j p. M m b k m m GAP y pm pkk. D kmm m zj b, w m zf m km j. V Dm: F f k wj, jk wjz V Dm: F fk wj k, jk wjz, pb Dm: I j b m BIG 1.01 P 1 f 20

2 GAP-y 1.24 p.xx j GAP-y m p b B Ifmb N Gm ( 1.2.4) Op : Dm : Gmm: DEEL 1 (GAP-Ay) DEEL 2 (ImpAy) BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p B [A] E b fmb C I pb Gk IBF 2014 bk N z Bm W, pb b p fmbb p b BIG zj b z, k bjfp wjz wjk p b b bm? wjk p B [A] H fmbb w mm éé k p j, I fmbb fp 3 j p, z Gk IBF bk N z f z z bjk wjz, b z w? B[A] H C B&W wb I pz, b wk m fp Gk IBF bk N z fmb w, j f j bpk b B&W k z m zj ï? p. D b éé k p j pz, b wk Ifmbm bpk k B&W. k C[A] D CISO (Cf Ifm Sy Off), Zj CISO f y Off jmm Gk IBF/P&O bk N z jmm zj b. b m bkk fmb zj ö. D CISO pp k m. pp pm? b. D CISO b b m, z pp, f m.b.. b m m w f, km mpm.q. p p p b fmb m V[A] Ek jm wjk b Zj wjk w bf Gk IBF/P&O bk N z zj f. fmb jm b? G E kp w IT z wjz I wjzb p (bj ICT) k wkjk bk Gk I&A bk N z IT z. ( ITIL m : wjzb) w, b b p? G[A] D m mp mb I b m mk k Gk P&O bk N z Ambw. 125, 3. (bjb fmbb m C[A] H jmm wk w I bk w w m Gk B&W bk N z m (bw, z, z.) w? CIB-pfk fm xpp, I pf p w fmb pfk Gk IBF bk N z w, fw w bk m fm w bk, bjb f fmb b. fm IBD (z jk) f fw? Zj mpp? C [A] D CISO m IBD m zi IBD- I CISO? W z z m Gk IBF bk N z. IBD? B[A] H fmbb w mm éé k Bjk IB b m z ë Gk IBF bk N z j ë ( fkjk k) w bj? I pm PDCA-y? B[A] Pk b w p W pk b f Gk IBF bk N z jmm. x f p jmm? Bjk bk pp m w B O f fmb w, fm Gk IBF bk N z (bjb fmbb f P&C-y b) P&C-y, jjk pp jmm. bjk pp fmb w pp? IIfmb b (p b fw) Bjk IB b m f f p pfk I&A / bk N z mw bj b x pj w f k. b fw b x pj () ff w f k? I Vf f b f Zj x mjk ym pfk I&A / bk N z x bp wk (fyk, wk f ) m bb m ym b m zj ff x pj() m() bb m fpk mk (f), zj ' k b w km p wk zkjk p f? bm zj fi Vf f b f Zj x mjk ym, f pfk I&A / bk N z x bp wk w fm, w m k k km m ff (bj. k II Wbp f wjkk) f wm p f (b) m bb m pj k k km f bj ym b m zj fpk mk bm zj. (f) w p f? b bm? f IVf f b Z b, zj "b", Gk IBF bk N z x bp fpk mk ym w f? w I [A] I x pj ym b w p W ym m m p x pfk ff bk? N z wk w, w bwkkm (fm Wbp k, z j, jk k 14) f. bwkkm? V k bjb 5 ym zj x w m 1 ym bwk km ) f P 2 f 19

3 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p IE m x pj wk I /f bwkkm wk pfk ff bk N z bm zj, z x pj zj bm zj (bjb m ff w f b mjk z b), f p b y w pp. (z k ). Ok w b b w pp, m bm b pj zj w z? (bj. p) z. f IO fpk x pj w jjk Zj jjk pp fpk, pfk Aff bk N z pp. x pj? B A zkjk b w p b Dz b b w k w, pfk ff bk N z fw ïmpm bk b ym zj fw fm p bjfm w.? BD m b bj zj f f D m , zj f pfk ff bk N z f ïmpm. f ïmpm, bjk bjb BUb (wkk p) fw E b m pm zj bm k Ikp bk N z fm w.. m, kwp, fpk b fw wkk bp, pkjk, w w ( k SAAS / C ). w BI m x pj m m D p b k ff bk N z m wjz z w b w (wkk p fw) m k z fw wjz. bj m BI m x pj w m m C p. k ff bk N z m mk BE p bë w C p. k ff bk N z w b bkb, wjk BI m x pj C p. pfk ff bk N z pkjk zj BA bk mk w m C p. k ff bk N z zf b. D fm wjk b bj m mk fpk BD p, bj w, pp C p. k ff bk N z pj w, w b p km fpk km. Vb w ï w fpk w p I E bjfm I bjfm Gk I&A bk N z b w, z fm(zm), fw, b w z, fm(zm), w,, m k/. V k m fw, w,, m k/? w, bm wjk jm bk. V k m w, bm wjk jm bk EV k bjfp, pp, zm ICT-f wjk jm bm A [A] E zj pb bk bjfm (m m, -m mb pp). D CAR-UWO p mb z. V x p AGbk bb k A App, fm pmm m z mm f w mm. D mm k k w k ffpk m mwk A[A] Ifm w bk wjk fm bkb k km b p R [A] D f bj p R I mm m Wbp, zj b (k 16 Wbp) b p L [A] D jm f m ff m km - k k m b fm. b L[A] D p fm b b z p fm. D bfm b. I k bjfp, pp, zm ICTf wjk jm bm? Zj pb bk bjfm (m m, -m mb pp). Bjb b fmbb f p? I bww m w, w k? I b f fpk w w m b pp f fm f pmm m w mm A w bk wjk fm zj m m m fm p b z bm. (zk b, ICT p.) E zj bj b m? (Dz k bb f p bb m). I b b p? Dk bj z m b, my, bw / fm,. B b p b w z k bk. Gk I&A bk N z Gk I&A bk N z Gk IBF bk N z Gk I&A/IBF bk N z Gk I&A bk N z Gk IBF bk N z pfk ff bk N z pfk P f / bk N z Gk IBF bk N z P 3 f 19

4 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p R D k wjk mwk zj pm Zj fbj b m Gk P&O bk N z fbj w. I fbj fbj m p. w mm b : fmpbb bm bjfm pp b xp m wjk b p R [A] A mb mwk kj bj B " " p w Gk P&O bk N z wjk z mb mwk bj fmb z. D fjk wjk, z fmb, z z fmb, kj? wk zj bj bb, w p Okm f mk m mkkjk kjk p z. Okm x pj. Ok kjk f mk m x pj. Ok. kjk R[A] I mwk p wjk f... I p b fbj f wkzm jk Gk P&O bk N z fmb m (f bj mk wk wjk z fwjz), bj k bf f bj f fmb mwk, bj k, b jk mk. bf f? RD m w b mwk B b wzj wjk Gk P&O bk N z b wzj wjk z z b? b. H b mwk bk zj m Zj mwk m bk? wjk p b b S[A] V mwk (mb x mwk) Zj mwk VOG? I Gk P&O bk N z mm Vk Om G (VOG). I wf VGB. M p m wf bf w k zk. (Vk G Bzw) SBj w mwk f k I p p b Gk P&O bk N z zj b f. w f S [A] H zkjk m VOG f pk z bjk m? Gk P&O bk N z f AA p b wkm, b p Gk P&O bk N z p x bk m w b k b, w wjk z fmb b zj DH jmm f wkk ïmpm Dz k b : B, pp, p, Gk P&O bk N z m bj p k,. mmb p ( k bjf p b IB f) k bkk DH jmm b mmb, D b k b, p, bww Gk P&O bk N z p (w p) x bk mp, p myy bzk (bjb). ym m bp p km b b A mwk w m mk D b k b bk, p, Gk IBF bk N z p bb bp, bww mp, p myy bzk w z f. (bjb) b [A] Bpk wp fmb f- wjz f p w km Gk P&O bk N z bpkk mwk f bk bjb k? w D [A] E p p mwk bk Z HR-b m? Gk P&O bk N z mk p bb (z k: CAR/UWO 16, p ff) BV mb mb f bf wk C f z b Gk P&O bk N z p k bë b f bj ëfwjz k bj. V p (zw bjf f ). I w mk k B H jmm f p bë C f z p p b. Gk P&O / bk N z b, f km w mm jm ëb w kk, m bjfm wk p k bë b bj BH jmm f p C f p z p. Gk P&O / bk N z f b, w mm b w jm ë kk m bjfm m zj bë f RR bjfm: Z Gk P&O / bk N z ( H jmm f p jm f b, w mm b w kk m bjfm m zj bë P 4 f 19

5 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p B Bkk : Z Gk P&O / bk N z ( H jmm f p jm f b, w mm kb w kk m kf bjfm D m m m w zj bë z. C zb m. Gk H bk N z ydz z b :.Z 0: m bw b.z 1: wm pkkm.z 2: wkm k.z 3: ICT-m / b m bjb pp p bf V z (b f b bw) zj jk C f bz bp zj. Gk H bk N z ybz bp F Gbw b w (bp p b C f bw w b (bjb Gk H bk N z yfw) bj w z bk ICT kmk, wk ). m F [A] E zj p pkk zm mkpp Zj bj pbkb f p w pbk Gk H bk N z yp, m m b wm w mkpp p? pkkm m w bzk km m m mb F E 24, 7 p wk bwk; bkm kpp C fpk f z. Gk H bk N z ym mmm F [A] V bwk f f zj C /p. Gk H bk N z y wjk W P B Rb. Dz f w mm jjk kf I bw m m bp z p Zj m? Gk H / bk N z y. H w bj. H bp z p? I&A I p? F [A] V p m b, w W b bj Gk H bk N z yz p p wkzm k bjk p? w. (bjb B, B ) F T bw f bz mjk I bw bz mjk Gk H bk N z y.? W w? F[A] D bz b zj I mjk b w Gk H bk N z yfm mjk b. bz b? FI bw m b z bp z p Zj b z? Gk H bk N z y. H w bj. H bp z p? I p? F D kw m (,,, V wk m kw m fm Gk H bk N z yp) fm p z. p z? FD f m w. I m f (p )? Gk H bk N z y F N m w pb b Zj m b pbm Gk H bk N z ypbm. pb? F App bkb kbm pm Zj kbm? Gk I&A bk N z y zf... b z w H bp z p? mpm. I p? F [A] E mm éé k p f j pk W fjjk? Gk H bk N z y/ p p fyk. I? B Pp m mb wjk W pp m mb m pfk P f / bk N z fm b w b p, zj wjk wjk fm b p? fm p mb S [A] E f b kz m p wjz E fm b p b Gk H bk N z mb m p, b p kz wjz mb, m p b b fm. b fm [A] Sm, kpp Zj m, bkbym Gk I&A bk N z bkbym zj j m b p. E b p z TIA-942? b z b p Tmm If Zj m bk? S f D C (TIA-942) f NEN-m NPR 5313 f Ep m NEN-EN BBj m k m pfk b z p f BR pp bkp zj p z f b éé zf m k z zw f bkp/ m kjk zj B [A] B m w z bjfk pp b zj b w B[A] Bj bkk w bw w kz wbj k w m k p mp m zk mp. I bj m k m pfk b z bw f? I bkp p w k bkp ff- bw w? W z p f? Zj m m bjfk pp b w? Dk m bw f bjb w f m p m bjfk pp. I bj bkk bw kz wbj k m k p mp m zk mp? Gk H bk N z Gk I&A bk N z Gk I&A bk N z Gk H bk N z P 5 f 19

6 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p B Gjk f bb m zj p z f Zj b m bb f jk m Gk H bk N z b m p m m z m p? f p b m. Bjb pkkm f jk ff? B [A] E bw k k I k bb pp? Gk H bk N z bbpp p. D w jjk W z bb pp jjk? W Mwk zf zj m I p b b p fyk Gk H bk N z b b p jk zk b m p? kj fyk b m w ICT z kzj p f w m wjk fm w wk WB m (z m f k) w z B m f zj w m zj w Gk H bk N z p b zj f w m. m, bjk p? Bjk pp? k W Z xp mm m b b m I b w b b m Gk H bk N z pm (f, f ) w mk. pm m w mk? S jk? k O [A] E b p m m pkk I p m m p/pkk? Gk H bk N z p b pkm - m bp App w p fm f C z mjk f pp fm f Gk I&A bk N z. D mm mp, p., pb pb. - Tmp pb - pb PS pp w wjz bjb C f p p Gk I&A/IBF bk N z ww w wjz bj bkm ww. pp. C f f p ww P Gbw zj b bkm. Zj m m bkm, z j Gk I&A bk N z wk? P E k b mpm. B b p mpm b p Gk I&A bk N z k? W ww? P [A] App j b I BIG w zj ym b k Gk I&A bk N z k km bj wk fm. I mjk wk m wjk. I fm wk w w ym bk fmwk f ym bk w w. w N App b w bm m W pm bm pp UPS Gk I&A bk N z bk z. ym z m pkm? BV- mmkb k f Zj - mmkb bm fm NEN 1010? Gk I&A bk N z fm w bk, b p f b w bm fm m NEN O[A] Rp pp (w) p W pp m p m Gk I&A bk N z p b p, zj p pp b? wz f kjk. I p pp b w b? B A pp b w b m fyk I pp p b wj p b fw pp? Gk H bk N z bm z m z zj fyk bm bb? p b fw. Zj m ïmpm? V[A] Bj bë bk f bj f w pp W fm bj bë bk f f Gk I&A bk N z fm bj b. D bj ICT? b z w f z I p w f ICT m? p pp wz f kjk. A k w I p wj pp? pp f fm fyk. H f f I f / pp? w p bjf V [A] Hbk pp b I p wj pp w Gk I&A bk N z fm wj m m. E z wk? m S E pp. I w w k m, éé k m m w f f j k V App, fm pmm m I p mm pp, fm f Gk I&A bk N z z mm f w mm. pmm. I w mm m m pp, w pmm f m m? GBp b fm p, f, bk-, f f, b, - p Zj bp : Gk I&A bk N z pp, p p m - f b. - bk-p - f f - b m - p - p p m b? G E zj p b m p Zj p b m p Gk I&A bk N z, p, b, bpk, z,, p, b, bpk, z, bk. bk. P 6 f 19

7 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p W I p wjzb mm b : I wjzb p? Gk I&A bk N z m f wjz W b m p? j mpy mjk wjz z kp wjz W[A] I fmbf (bjb y W fmbf (b.. y Gk I&A bk N z fw) p kppk w w fw) p kppk w w jwk, w m p wjz. wk, m p wjz? z FNm f p m p I k b ym bk Gk I&A bk N z bb m y k ym? Bjb: p b b f fmym b. D b m j f zj kmm b k zzf f m b f k b bj k zj. b. D zw fmwk b. A b, b k w bkp mk f b b, m pp zf F[A] E bk bkk. I k bk bkk, m Gk I&A bk N z Bwkzm w w? b, m bkk w bk F [A] Vóó wk kk W wk kk pfk I&A bk N z fm f kk fm ym k w z fm f kk fm ym k w p ïp p. V p w p? p w bj. E w bj? F[A] Vwjk b, wjz Zj wjk b, wjz Gk I&A bk N z bjb fmymf, m wz bjb fmymf wz éé zj éé pfk (b). pfk (b)? E zj mm ym Owkk, T Zj mm ym Owkk, T Gk I&A bk N z /f Ap P (OTAP). D ym pp z /f Ap P (OTAP)? z bï ym pp z. (D ym pp z z bï ym pp z.) Gbk bb bkpf Owkk, T /f Ap Pym m f m. H m jk zb zj wk ym wk w [A] I xpm f bm m, z fyk pm DD b pj bjf wjk bwb b DUb k fmym wjk jm C E w fpk mk pp, z m b C D bwb w m. D k bjb m f pp b mm p j ( ym). Hbb bk bkpf Owkk, T /f Ap Pym? W ym w p / m wk ym wk w? I xpm f bm m? A xpm f bm m, z fyk p m? Zj b IT ym? I wjk b pj? Hf wjk m b fmym k? I k? Zj fpk mk pp, z m b? I bwb jjk w m m / f pp? Zj bwjz m pp/? Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z pfk I&A bk N z Gk I&A bk N z pfk ff bk N z CE zj b pj pkp. Zj x pkp/ bk pfk ff bk N z? k / I&A B Z Bj b fmym: Spfk ff bk N z I wjzb p? W b m p: m f wjz mpy mjk wjz kp wjz C[A] D ICT-z V ICT z km pfk ff bk N z km bkb. E w z bkb? k / I&A pïmpm m bkb mp bwk Zj bkb? (bjb p wz mp I pb p? m bk mp ). Op b p bk w m m C j [A] E w b bpk b p p bk bwk. ym I p b, m m m, w Gk I&A bk N z z bk mppjk m, z bk mppjk m k p z pk bk (f ym) m z m k p f? zj f k m bkb ym bk (f ym) k b C [A] I kppp m x f w z w Zj kppp m w f x z? Gk I&A bk N z m ff m DDOS (D f S) Zj m m m DDOS p p. H m p zj p? wkp z p, bkb f mp S[A] V p w bj. Zj ym p? pfk ff bk N z y k / I&A P 7 f 19

8 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p S E zj p b. D Zj b p ym mm OWASP f pfk ff bk N z ybf mm OWASP f jkw. jkw? k / I&A Bjk z p bk w bjb m ym? M [A] Bj p b w z m Zj p ym ï b Gk I&A bk N z p, j mw. D p bj p? f fq, mm éé k p, m V p f jk p? p M[A] Ikm -m w p, Zj p m ym ï b Gk I&A bk N z j mw. D p f bj p? fq, mm éé k p, (m) p. V p f jk p? M I k k b f W k f Gk I&A bk N z w bj k pmm pmm bk? p M [A] E zj m m p Zj m m p Gk I&A bk N z m bpk (bj. q mpm). m? I j, wk m? M E zj ïp m w Zj ïp m? Gk I&A bk N z mm m bkp Zj m bkp pmm zj b. pmm b M Op mb w fw p, wbj bj BYOD Zj mb bk? Gk I&A bk N z bk p z zf p. I fw z mb? I BYOD b m? I b bk p w fw bk? M Mb w ï m W bk mk ï m m Gk I&A bk N z (bx) m k p ym mb? (Mb fw k. D mb w j m mm ym w wk w p z ym w. ym, k bjb jp f f m. M b bw m k k ME bk m x k k m I bj, k ff x m, fb pmm' f PDF mb zj) Gk I&A bk N z pmm (bj. bw) mb. bkk bjb py? R E zj () p bk-p y fm Zj bkp y p f pfk ff bk N z f wk. fm /f wk? k / I&A Zj z p k? R Bk-pë zj p b Zj p bk-p ë? E k Gk I&A bk N z (b, b, z.), mxm p w m p? m k, mxm b bk-p- j R V bk-p bjfp m w I w bkp zj Gk I&A bk N z bj, m kp p. D kpë p k m z kz /m p mxm p b? pkjk f kp RBkp w bw p z kz Zj bk-p bw wj Gk I&A bk N z p pkjk bk-p. pkjk? R D fyk bkp, zw ymj I z bkp mjk Gk I&A bk N z, z p z p? k ff z bkp M H wk w m b z, f W bk mk wkm z f Gk I&A bk N z f k k w bwb j k w? wk fpk mmm km M [A] Gw w w z W bk mk mw p kppkk Gk I&A bk N z jk m w p wz (w w z)? mw M [A] Bj p wjk fm w W bk mk yp w fm Gk I&A bk N z wk, z, j k yp w w wk p w? p. Z M E zj p b pp p f. W b p f p zj p? Gk I&A bk N z B Bkmk, b Zj bkmk, Gk I&A bk N z wk b w ïf pm b x wk. Ok k km wk, zw b? w b B[A] E zj p p ïmpm p Zj p p wjk fm p Gk I&A bk N z wjk fm wjb m. wjb m z k, b-k? B [A] Vwjb m m wjk fm m Zj p NIET b Gk I&A bk N z b w p p kjk zj z wjb m p w p? B I m k w bb W bj w mm bk m Gk I&A bk N z z b, w kp w 75% p z z j w ( mm k. mm p 75% ) (j, p, k) B G w b f W b fm f Gk I&A bk N z fbk. fbk? P 8 f 19

9 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p V [A] E zj p wk Zj p wj wjk Gk I&A bk N z wj wjk wjb wjb m? Wk m w bj? m. Vwj w m S E wpp w mjk. I w w k m, éé k m m j w f f j k. Z k PE b p w b Zj p z fm Gk I&A bk N z p fm m z bm b k km b p z pbmk f mbk. fm mbk k w f pbmk? B Symm wjk fm b j W ymm wjk fm b j Gk I&A bk N z kjk. b? B[A] W xp k m b W ymm b fm b Spfk E bk N z ymm b m b, j z fw b m b? I j, w z fw. bjk? B[A] H mm Dpm Vwjk f jkb W wjk fm b m Spfk E bk N z f fm, f, b m b f f zkjk? p f f zkjk W bjk? BMwk zj ï m z m m Zj p zj z bk bj mwk w Gk P&O bk N z (f)pkk, -m, fx, pk b p m m wjk fm? wpp bk b k p kk wjk fm mm w BMwk zj ï m z m m mb Zj p zj z bk bj mwk w Gk I&A bk N z pp wjb m k p kk m m mb pp wjb m? wjk fm mm w. Hbj w m G k j p bpp p b j p mb f? bpp mb f B Mwk zj ï m wjk m bj I p p wjk m f pp? Gk I&A bk N z p BE zj m ff m m -W m p m z m Gk I&A bk N z m b x -m km. x m b p z m? UE zj fpk mk b w Zj p w wkfpk f mm pfk P f / bk N z fw w m m b wb wb zj bwb - w b wb - z? w wb zj b U Vwjk pkjk I mm p z wk? Gk I&A bk N z fmb zj b, m p m. w UH p pmm I w pmm? Gk I&A bk N z wjk bm,, pmm zj. w U[A] I mjk w bkm pmm (zw p I mm bkm pmm? Gk I&A bk N z fyk m w) p wjz wk km f f F Om wjk fm bm w m Zj m m m w fm bm? Gk I&A bk N z ym, z: (z b) bm fyk m, z f bk pkkm w z f kp pjk f m pp z m z F[A] Fyk z bjz fm m Zj p fyk z bjz fm? Gk H bk N z yk m, w zb, kb bk b E [A] D m b m w bk W bk mk f bk Gk I&A bk N z k mk bk PKI O f k m? k /f yp. k E E (pm) f -m b. I pmf -m? Gk I&A bk N z k S E zj j m bkk bp ' Zj j w b w z Gk IBF bk N z ybk mjk fm kpp m z bm bj bk bp b k mb j bp b z pp? fm b z kpp. H mm b fmz, mkjk ', fm m, py, bkb, bkp km C E [A] Cfm p w k b W k b bk? Gk I&A bk N z - bk (b.. GBA). (m, m bk) m P 9 f 19

10 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p O E w b () (kwf) W b m k k f Gk I&A bk N z k k f w (bj. TAN ) w? bk O E, pj zj py W pj Gk I&A bk N z bkk pj wb. py wb? O E zj p wb pb fm Zj p mwk fm Gk mm bk N z p mwk. k pb? bl V b w pp mk pk w Zj pp? pfk ff bk N z b. Dz p w mjk mbk k p. D GBA k bjb jk p w, fë ym, I bk k bjb p m f kw LE b mm: I w m (z )? Gk I&A bk N z jk p b bkm f ID b (z ) w mjk P wkp f P bj wp w m PjPp b L[A] I w pm. B z ww? Gk I&A bk N z D bf m wm b bk k w (z ww, bmm, z.) L[A] Lb w zjk m. D zj ym W b zjk m? Gk I&A bk N z b bj k p Sy Ifm E Mm ym (SIEM ) wm m mpp b w. E bj wk mpw m mpp w LC p p : p pmm I p p pmm? Gk I&A bk N z b b bp w m m b. D k bw (m) mjk (bj. bkb ) LD b w pm W b z m pm Gk I&A bk N z :? bk bfp, z wjz f f ; ymmm, pp, bk-p f bk fp bfp, z wjz f, w f, p (w b) bb, z p f bk, k kk, ww, f kk yp L b H (m) j (z f wz wj mw, b w p W j, wj w p Gk I&A bk N z w.? L[A] H p b b I -y bk Gk I&A bk N z bk. Hbj bpk. bkb? LLb w z bm z p f W mp p km? Gk I&A bk N z mp k w LD mm w z bm z W bm? Gk I&A bk N z p f mp k w. I p m w z bj j pp p w L[A] D bkb fm wb b I mm mj 3 m Gk I&A bk N z mj w y zkjk w, m mmm m w mm 3 j? m, fm w ym. Bj (m) fmb bwmj mm j LC p p : p pmm I m p? Gk I&A bk N z b b bp w m m b. D k bw (m) mjk (bj. bkb ) LZ Gk I&A bk N z LZ Gk I&A bk N z P 10 f 19

11 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p L Symkkk w z y j Lp ymkkk jk? Gk I&A bk N z bwb y b mjk TE b b w, m I b? Gk I&A bk N z b p b bjf b R Gbk w f ïf. V I p w bk? pfk ff bk N z w m bj. k / I&A R [A] A w bj éé bb z W 1 bb bj k? Gk I&A bk N z R [A] Op b fw w bp w p wk wjz I fw bj bp pfk ff bk N z f w p wk w f? k / I&A B Gbk bb p b z W p b bk z zj? Gk I&A bk N z f k zkjk ( kw, ) B Symp bkm ( D ymp? Gk I&A bk N z f ), z z p ym f bk B Gbk kj zkjk Kj bk z bb? Gk I&A bk N z pp mm B E wjz b bj I b bj wk..m. wjz pfk ff bk N z f / f. b? k B Ww w m (px) p f W ww bm p f Gk I&A bk N z, m p w bjb w ( + SALT) ww mb m p B T z ww : I ww p f b w Gk I&A bk N z Ww w p m ( m m p w? bk). Tjjk ww f ww Xw f w w m w bj bk pjk ww. Gbk bp ww. Ww zj bj bk bk. Ww b mm 8 kk, w m 1 f, 1 jf 1 m k. Ww zj mxm 60 m b 6 bk w BT bk w pk, mm jjk, W mm jjk ë? Gk I&A bk N z ë. H b b bp p b G A bk k m mm Zj bk bz? Gk IBF bk N z : b Ww w p. Gbk ww m. Ww m p zj E ww w mjk wjz m k b bk w. Ww w bk m p (bj. p f f m). w OD bk wkpk j fwz. (z k : I k py? Gk IBF bk N z ) b C I k b mm bk E : Gk IBF bk N z wjk fm p b m. Dz fm D bk wjk fm p b m m j w pb fb pbmjk. Dz fm m j w pb fb (k, k, b f km). pbmjk (k, k, b f km) CBj fkk fm w, w mjk, bk I f b fkk fm? Gk IBF bk N z mk f b fkk (p f) C[A] Smbpmm ( ) mk I m wk mxm 15 Gk I&A bk N z p mxm 15 m fm p m? bm b kjk C[A] Tb k w m bj I k/ m wk k Gk I&A bk N z wj k ( wz). wj w? I wz! BE m b m bkk bk I wkbk b? Gk I&A bk N z wk wk. Gbk kj wk wk zkjk zj. Z k AZ k Gk I&A bk N z P 11 f 19

12 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p I[A] A ïf pp k w I pp k w Gk I&A bk N z p w z. E,, pp p w z? (B Y Ow D) w p w z BP, jk z p wk f I p p mm? Gk I&A bk N z mp zj w f S [A] Wk w z k I k wk z mjk? Gk I&A bk N z z f wk mjk S[A] D z b f p I b z w z ë? Gk I&A bk N z p bm w wk p z w. V ym w bj wk z z. E w pk, mm éé k p j, ë f ym pm z z f p m w S[A] Ek z f f b Z f Hbb z f b? Gk I&A bk N z z fm p z b b. Hbj p p p, mm S[A] B z p mm I b z? Gk I&A bk N z, p z SZ w m z w f I? Gk I&A bk N z bpk k zkjk ( z) BV mppjk wk, w z z I b bj z j mppjk Gk I&A bk N z j, b mjk wk? bk w bpk, km b bjfp (z 11.1) BNwk zj z bm Zj bm f b Gk I&A bk N z b p mm f b bmm? bmm B [A] T k p f p m W bk mk w-f bj k f b pfk ff bk N z b w p b w-f. p? k / I&A BH ww w p m j. E I ww bj b? pfk ff bk N z w fm b k / I&A BVf m w bk m I m bk bj? pfk ff bk N z bk xp k / I&A BBj p w m j I bj m? pfk ff bk N z f p. Dz fm k bk k / I&A fm ff /f mbk ym B[A] N bkm 3 k ff ww I kp? Gk I&A bk N z, w mm 10 m bkk. I k- p k w, w bkk bk zk z k- p ff f ww GBj f m w mm f bk f p bm G Bj bk IT z w bk mm p b ww. b G [A] App m zkjk ym ( p z m f ) b. D w zj, w w k w bk ( p ) ks E w m p bk ww y(.. k ww, m wjz, wjz ww) S [A] Ww bb z b bj y Db ww w wjz. W ww p, w bkk S [A] Ww zj ë ww bb yz bpk m bj bk w wjz. I p f m? Gk I&A bk N z I mm ww bj bk ()? Gk I&A bk N z Hbb pp m? Gk I&A bk N z W m p bk ww, bjb py ym f pp? I ww w fw, bjb py ym f pp? I k jjk ww bpk, /py fw ww bj bk w wjz? Gk I&A bk N z Gk I&A bk N z Gk I&A bk N z P 12 f 19

13 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p S D bk bb mjk ww kz Hbb bk mjk ww kz pfk ff bk N z y wjz. Hbj : wjz? k / I&A bk zj ww k wjz, w bk Hbj : pw. bk zj ww k wjz, w km ypf w kz ww bk pw. m bp. km ypf w kz ww bp GH bk ppmm wm ym- bk ppmm wm ym Gk I&A bk N z pbm z k w p pbm z k w p, bb w bpk b k w b. bpk b? T [A] D p wk p I m 15 m f k k I&A bk N z mxm 15 m. D w PC. Bj m wk? mkp mxm 15 m I k m z? bk w B [A] D p f w W ym f f k I&A bk N z p p b wjzzk f m. M bj m, wbj p b wjzzk f p2-f. m w m 2 f? BI w m mk k I&A bk N z - jfb. p B [A] Mmfw f mjk bk f Gk I&A bk N z. p B [A] Bj x bk w m k V bj w m 2 f pfk ff bk N z (w-f) bk p. p? k / I&A p B [A] E b bk w-f b W b ym bk mk 2 f Gk I&A bk N z k pp. Bjb b m, z b m? ppw f k pw I [A] G ym (m bkb f Zj ym ï ym? Gk I&A bk N z wjk) b wz (ï) mpm bb. I k w bk fyk f m D[A] H mb pp w mjk z W mb pp b m Gk I&A bk N z bjffm w p ( z fp ). V bjffm? z fp () b, f f wjk, : I z fp fw bk mb pp (z mp, b, mp, f ww (p)? bpda) b mjk m bm.m.. ww. V p w m fw p D[A] E zj, w mjk, z m - pmm p mb pp. bk wk m w p. Op mb pp m w mw fw Gk I&A bk N z mw D [A] Bj m f f w mmmjk W bj m f f mmmjk Gk I&A bk N z m pp f. m pp f? T E w b m k mpm I wk b b m ( p?) Gk P&O bk N z k p... wk wt E w b m wk wk ym I wk b wk ym w wk Gk P&O bk N z wk ym w wkpk f ym m w p? wkz m w p. D b w bj I p fw? k MDM-p (mb wmm) T [A] D wkz zj w mjk z p I wk z z p wk wkpk Gk P&O bk N z wkpk ( f p ) bjffm w k k w p? p ( z fp ) mjk mw f wkpk E mw w k w k km. km? wv p w m f fw p wjk m ka I pj w by mbp I p f w bj pj Gk IBF bk N z pm wp. Ok bj wjz w y mbp wp? q mm. W k wjzb p? ya I y, wkk W bj y, wkk fmym Gk I&A bk N z fmym w b b bp? bp. W mjk w bk mk b j (bj. ). y A Bj f p w p wbj b W bj b p b mm pfk ff bk N z pf. pf? k / I&A ya W m b p w kz Zj b p bk w Gk I&A bk N z bp p w bw. w bw? y P 13 f 19

14 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p A V b w mp bk b b bk mp b Gk I&A bk N z p b z NBV k f b NBV f ISO/IEC 15408? f ISO/IEC (mm ). y AE xp, C f p p Gk I&A bk N z ww mjk j. ww. C f f p ww yv E m w p. C f bj pp pfk ff bk N z Dbj w mm p w, k,. M m bb wb pp, k / I&A, j fm, bj NCSC f OWASP j. pm (SQL-Ij) BE b mjk m Zj mjk m pfk ff bk N z k k B H fmym m f b wm k W /f wkf m pfk ff bk N z w f wk zj. Hm w m m / m b wm (jk) - mjk wk p w? wkf k w B Sp f w km p p Zj p mm z p pfk ff bk N z mm. f w km? k / I&A B Vwk zj bj k b z bj p Zj wk b f? (bjb pfk ff bk N z f /f wk fm k w wk bjb, bwk ). k / I&A pw wk fm I E b w, k bm Zj z bm ïmpm pfk ff bk N z w ïmpm, bwk bwk bm k / I&A bm b b p. (k fz, yp, p. pp ) VD f pmm' mk mjk m Zj pmm' m f wbj pfk ff bk N z j k (bj. j k w. k / I&A km) V Bj w z m j W w m j pfk ff bk N z wjk bkb w (bj. b wjk bkb (b bj f?) k / I&A p) V A zkjk zj bk W bk mk kw pp, z pfk ff bk N z w ( kw). zkjk zj bk w? k / I&A B D bk ypf m zj p W ypf m bk p Gk I&A bk N z m zj fkjk bwb zj f fkjk k? k. (bjb AES) BBj Bj z ypf p fw I b z ypf p wbj Gk I&A bk N z, p b pj. fw mk, p b pj? B[A] D ypf bz mp V ypf bz m Gk I&A bk N z m b b (z FIPS w b b? mjk NBV) SI b mm b p, I, bk mk w ypf b Gk I&A bk N z wjk. p m wjk? S D ypf w bp I ypf b wk Gk I&A bk N z b p ypf p? b S D wjk ypf zj wb I b bp wb wjk Gk I&A bk N z j, bk, p p. j, bk, p p? S E p w bp w m I p w bp w m Gk I&A bk N z m mpm. m mpm? S [A] Bj k mm PKI O I mm bj k PKI? Gk I&A bk N z B A p k f fw f K p f fw f Gk I&A bk N z.? B Pmm b p w ï p W pmm ï p pm Gk I&A bk N z pm p. p? B Gï pmm, f m w W ï pmm, f m Gk I&A bk N z bj fb. bj fb? B E w ( ) fw W ( ) Gk I&A bk N z bk. fw bk? P 14 f 19

15 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p B V p w bj. I bj pmm p? Gk I&A bk N z B E bk. I w f wjz pmm Gk I&A bk N z bk p / /? B H bk kpë p b W bk p b m? E Gk I&A bk N z w m. I zkjk, w z mjk, w bk mk mjk m z wj. m wk z w wj? T D b w z mjk bpk m W b z mjk bpk Gk I&A bk N z b wjz bm. A p p, m b wjz bb. bm? T B p p () ym. S b p p () ym. (O-m)? Gk I&A bk N z P E b wjzmm b b I b wjzmm b Gk I&A bk N z p z ITIL pp ASL. b p z ITIL pp ASL? T V p (z p) fwm mp W p (z p) fwm Gk I&A bk N z f w z j wk mp f z mp b. j wk mp b m? RBj bpmm pmmpkk W bj bpmm Gk I&A bk N z w wjz. pmmpkk wjz? U Op k w w m V p k w w Gk IBF bk N z - p. m - p m kk fm? U E p zj m m (p) fm I p m m (p) fm Gk IBF bk N z k. (z ) k? (z ) U Ub wkk pmm km W p wjk b Gk IBF bk N z p wjk b. E b wkk pmm? w m ff m kw wjk W m ff m kw wjk bb (bj., bkb b (bj., bkb m, f, kw, m, f, kw, pkjk). pkjk)? B E p b kwb; E p b Gk IBF bk N z m mm m IBD, pk kwb; m mm m p, y kwb p. IBD, pk p, y kwb p BV fwm z f k W fwm z Gk I&A bk N z (bj k m) w f f k (bj k m) f p (p) zj. H p p (p) zj? m p, zj p fpk zj m B I p bkb, ' b m I m pmm wbj p Gk I&A bk N z p w ë ( ' b m bkb, ' b m p kwb k w m ' w ë? p) B [A] Up/p kwb w k p mbk W k p z p mjk, b wk, Gk I&A bk N z w w z p mjk, ïmpm?, mm b éé wk. M k b-p/p m w p bj BI p bkb w I p w NCSC f CERT w Gk I&A bk N z IBD f CERT z bjb NCSC. mm m m kwb m R E p pp bb I mm p z wk? Gk IBF bk N z, mb m - p p, w w m w pm pp b R E p mm m IBD. I p mm m IBD? Gk IBF bk N z p p R [A] E p Dm Sy C (DSC) f VCIB f I b m ACIB /f VCIB wz? Gk Gm bk N z ACIB wz pp b. V I k wp b m S p k wp wz? pm m RA b w ym W b ym Gk I&A bk N z ë IBD. IBD p? p pr Vm f f pp f m W m f f pp f m Gk IBF bk N z m k b w j k mk b f k b mk pfmb. fmb? p P 15 f 19

16 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p R Ifm b, bjb W fm b pk Gk I&A bk N z, f p, bk w m kk bjb b. pkk. D CISO bkjk pk bj k mjk - Kjk CISO pk m fm (bj pm fm. k mjk)? RE p m b zwkk I p m b zwkk Gk I&A bk N z pkk b m. pkk b m? p p V E zj p pp b. A Zj p pp b? Gk I&A bk N z mwk b p zj z p. Zj mwk p z p? L D fm k b bm W fm k b Gk IBF bk N z w ë m bm b. (PDCA bm w ë m Cy) bm b? VV p b I p/pk zm, bw p Gk IBF bk N z b bwjm w zm, bw p bwjm km f bwj bm (km f zb zj. bwj b zj )? m I[A] Cmp w bk jjk bww-, W mp bk jjk bww-, Gk I&A bk N z -. -? f W bjk? B E B Imp Ay (BIA) w b w I B Imp Ay (BIA) w b w Gk IBF bk N z ïf k ï bjfp. ïf k ï bjfp? A y zj wjjk I bj k b wjjk ï k b m j, ï m j, p? p. j f CI ïp w mm b : Zj ïp? Gk IBF bk N z PfP Pë p bjfpï. w mm w b : w p m P w, m k w w PfP Pë p bjfpï. w. w p m P w, m k w w fmp (b fmp). w. p P. fmp (b mp ym p. fm). ï k k p m p w p. p P. mp ym p. k k p m p w p KE b k k bjfïp W k k bjfïp Gk IBF bk N z w f m bwk p f m bwk p zj, m zj, m fmb p wjz fmb p wjz b b m p. m p? [A] E w mm jjk f /f m [A] E w mm jjk f /f m Gk IBF bk N z bjfïp m bjfïp m (pz, b wk). A (pz, b wk). A w p bj w bj. w p bj w bj IE wk w wjk m p E z wz w wk w /f Gk IBF bk N z zj p f. wjk m p zj p Dz j pm p: ()? Z j w z z? p:// /p/2014/04/ _cpj--- Ifmb-040.pf f IE z p wjk p m.b.. I z p wjk p m.b.. Gk Ikp bk N z m, bk. m, bk? BBjk b w bm, W bjk b w bm pfk ff bk N z, km wjk,, km wjk k / I&A, p bjfm., p bjfm? B D bm py b w W bm py bwk pfk ff bk N z bwk km w, f km w, f k / I&A p bp. p bp? V E b m bkk bk ICT z I b m bkk bk IT z Gk I&A bk N z bk. D b bkmk p wk bk? w z D b bkmk p wk w z kv E wk km, w f I bk wk km, w f bk Gk I&A bk N z p ypf k m. Z k ypf p wk m w? N H jmm wjk I zj p b Gk IBF bk N z bp p (.. jjk mm. Dz k x zj. W k). Cfm BIG ( k) z CISO, m pp? Gm S, z p bb. Dbj b k pk b. Dz k w f w CISO w f x m N [A] I P&C y w pp fmb W P&C y pp fmb pfk ff bk N z m. m? k / I&A P 16 f 19

17 GAP-y 1.24 p.xx j BIG Nmm GM V Awz Vp / pmk E S A W? Gp? Gk/ PIOFAH pfk /w p C Ifmym w m p W fmym m p pfk ff bk N z bm. D k bj. kwby bm? k / I&A p. Z k Bjb kwby p B E wbj w W wbj w pfk ff bk N z p pym, b z w p p pym, z p k k / I&A k m bjfp m bjfp mmm mmm bpk. bpk? B T pm fmym b W pm fmym Gk I&A bk N z w bm m mjk mbk f mpm b bm m mjk mbk f mpm km. km? I D m ISMS wkk, I m ISMS? Gk IBF bk N z S b, b k W ISMS b? Mbjf. Dz m pkjk BIG m m S m b k m T b z w p m. Bw m JA p. b p PDCA m (P, D, Ck, A). Dz m p z j wk z b m b (wjk p). P 17 f 19

18 GAP-y 1.24 p.xx m 29-j R GAP-y Rw Lb P Mxmm S 5. Bb 0 / 2 = 6. O fmb 0 / 27 = 7. B bjfm 0 / 10 = 8. P b 0 / 18 = 9. Fyk b 0 / 41 = 10. B mm bp 0 / 81 = 11. Tb 0 / 54 = 12. Vw, wkk 0 / 43 = 13. B 0 / 10 = 14. Bjfb 0 / 5 = 15. N 0 / 11 = 104. ISMS 0 / 1 = S fmb p b BIG m 14. Bjfb S GAP y m (GAP-y) 15. N 104. ISMS 5. Bb 6. O fmb 7. B bjfm 8. P b G T (m fk k, b b m mkk, k f) 13. B 9. Fyk b 12. Vw, wkk 10. B mm bp 11. Tb IMPACT-y, b, 0-m ( ) Rw Lb P Mxmm S 5. Bb 0 / 4 = 6. O fmb 0 / 54 = 7. B bjfm 0 / 20 = 8. P b 0 / 36 = 9. Fyk b 0 / 82 = 10. B mm bp 0 / 162 = 11. Tb 0 / 108 = 12. Vw, wkk 0 / 86 = 13. B 0 / 20 = 14. Bjfb 0 / 10 = 15. N 0 / 22 = 104. ISMS 0 / 2 = G T (m fk k, b b m mkk, k f) S p mm b 15. N 14. Bjfb 13. B 104. ISMS 5. Bb 6. O fmb 7. B bjfm 8. P b 9. Fyk b 12. Vw, wkk 10. B mm bp 11. Tb P 18 f 20

19 GAP-y 1.24 p.xx k L, k. P 19 f 20