CSIRT ガイド - jpcert.or.jp

1 CSIRT JPCERT 2015 11 26 ( ) IT IT IT IT = CSIRT ( : Computer Security Incident Response Team) = CSIRT CSIRT 1 CSIRT CSIRT CSIRT CSIRT CIO (Chief Information Officer ) CSIRT CSIRT CSIRT CERT/CC JPCERT/CC ( CSIRT )

2 CSIRT CSIRT CSIRT ( ) CSIRT CSIRT CSIRT ISMS CSIRT CSIRT CSIRT JPCERT i 1. CSIRT .. 1 CSIRT .. 1 CSIRT .. 5 2. CSIRT .. 10 3. CSIRT .. 12 .. 12 .. 13 CSIRT .. 18 4. CSIRT .. 20 5. CSIRT .. 22 .. 22 .. 22 .. 23 .. 24 6.. 25 .. 25 .. 28 .. 29 7. CSIRT .. 31 CSIRT .. 31 .. 31 CSIRT 1 Copyright 2015 JPCERT/CC All rights reserved.

3 1. CSIRT CSIRT Computer Security Incident Response Team) = ( ) CSIRT (incident) (accident: ) (happening: ) 1 IT ( ) ( ) ( ) ( ) [ ] CSIRT ( ) Scan Forged Intrusion Phishing DDoS Virus Spam APT CSIRT 2 Copyright 2015 JPCERT/CC All rights reserved.

4 (1) (2) (3) 1 2 ( ) ( ) 3 4 100% CSIRT 3 Copyright 2015 JPCERT/CC All rights reserved.

5 [ ] CSIRT 4 Copyright 2015 JPCERT/CC All rights reserved. IT IT (= ) (APT) CSIRT CSIRT Computer Security Incident Response Team = CSIRT CSIRT CSIRT CSIRT CSIRC (.)

6 Computer Security Incident Response Capability = ) [ CSIRT ( )] A B A B A B C C CSIRT CSIRT CSIRT CSIRT 5 Copyright 2015 JPCERT/CC All rights reserved. CSIRT CSIRT CSIRT ( ) Constituency CSIRT ( ) CSIRT CSIRT CSIRT (1) CSIRT CSIRT CSIRT [ CSIRT ] CSIRT A B C CSIRT 6 Copyright 2015 JPCERT/CC All rights reserved.

7 (2) CSIRT ( ) CSIRT [ CSIRT ] ISP CSIRT CSIRT CSIRTAPCERTFIRST CSIRT CSIRT 7 Copyright 2015 JPCERT/CC All rights reserved. (3) CSIRT CSIRT [ ] (4) CSIRT [ ] A CSIRTB CSIRTC CSIRT CSIRTCSIRTCSIRTCSIRT CSIRT CSIRT 8 Copyright 2015 JPCERT/CC All rights reserved.

8 (5) CSIRT [ ] (6) CSIRT ( ) SOC [ ] CSIRT C B AA CSIRTB CSIRTC CSIRT CSIRT ( ) ( ) CSIRT 9 Copyright 2015 JPCERT/CC All rights reserved. CSIRT 1 CSIRT CSIRT [ CSIRT ] JPCERT/CCA CSIRTB CSIRTC CSIRTD CSIRT CSIRT CSIRT CSIRT 10 Copyright 2015 JPCERT/CC All rights reserved. 2. CSIRT CSIRT (1) ( ) [ 2-1 CSIRT 1] CSIRT ( ) (2) ( ) [ 2-2 CSIRT 2] CSIRT A B A B CSIRT A B A B CSIRT 11 Copyright 2015 JPCERT/CC All rights reserved.

9 (3) ( ) CSIRT [ 2-3 CSIRT 3] CSIRT CSIRT CSIRT CSIRT CSIRT CSIRT CSIRTCSIRT A B A B B A CSIRT 12 Copyright 2015 JPCERT/CC All rights reserved. 3. CSIRT CSIRT CSIRT CSIRT CSIRT CSIRT [ CSIRT ] CSIRT CSIRT ( ) CSIRT CSIRT CSIRT / CSIRT 13 Copyright 2015 JPCERT/CC All rights reserved.

10 [ ] A B B C A C A C CSIRT CSIRT Web CSIRT ( ) Web A C B CSIRT 14 Copyright 2015 JPCERT/CC All rights reserved. CSIRT CSIRT CSIRT CSIRT CSIRT ( ) CSIRT UCE(Unsolicited Commercial E-mail)