Transcription of CISOハンドブック - jnsa.org
1 1 CISO Ver. CISO 2018 6 22 2018 4 27 ( ) 2 1.. 5 .. 5 .. 5 2.. 6 .. 6 .. 6 .. 7 .. 8 3.. 10 .. 10 .. 10 .. 11 .. 14 .. 15 .. 15 .. 18 DevSecOps .. 19 4.. 21 .. 21 .. 21 .. 21 .. 22 3 .. 22 5.. 24 .. 24 .. 28 6.. 31 .. 31 .. 34 7. IT .. 35 .. 35 Microsoft Operations Framework (MOF) .. 35 IT.
2 38 .. 41 CISO .. 42 8.. 44 CSIRT .. 44 .. 44 .. 45 .. 48 9. CISO .. 49 .. 49 CFO .. 50 COO .. 50 IT CIO .. 51 CRO .. 51 .. 51 4 .. 52 .. 52 .. 53 .. 53 10. CISO .. 55 CISO .. 56 11. Annex A .. 57 12. Annex B .. 58 13. Annex C .. 59 14. Annex D CISO .. 60 15.. 61 5 1. GDPR EU (1) CISO Chief Information Security Officer CISO (2) PDCA CSIRT(Computer Security Incident Response Team)
3 CISO CISO l l CISO l CISO l CISO l l 6 2. CSIRT NIST (3) CISO CISO CISO IT CISO CISO 7 CIA Confidentiality, Integrity.
4 Availability 1 2 IT 1 J-Net21 (4) 2 IT CxO( ) (5) 8 3 SOA Sarbanes-Oxley Act Section 404 (6) IT IT IT 3 2015 (7)
5 CISO 9 CIA) DoS OS
6 2 10 3. IT ERM ERM 2 1 CISO 2 IT IT Confidentiality Integrity Availability
7 11 2 KPI CISO IT CIO NIST 3 IT 12 Pre-breach Post-breach CSIRT(Computer Security Incident Response Team) CSIRT CSIRT 3 (8) 13 4 (9)
8 Post-breach 5 Pre-breach Post-breach 14 5 (9) CISO Lockheed Martin (10) 1. Reconnaissance 2. Weaponization 3. Delivery 4. Exploitation 15 5.
9 Installation 6. Command & Control 7. Action Action IT IT IDS/IPS IT CISO
10 PDCA 16 PDCA Plan Do Check Act PDCA Plan Do) Check) Act PDCA Check Check Plan 4 PDCA PDS PDCA PDCA PDCA PDS(Plan Do See PDCA PDS PDS OODA Observe , Orient , Decide , Act PlanDoCheckActPlanDoSee 17 5 OODA Loop11 NIST ( 3) Framework Core Identify Protect Detect( ) Respond Recovery( )
